CVE-2026-54177mediumCWE-434

CVE-2026-54177: fallo de gravedad media en Laravel-Backpack CRUD

backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear CRUD+ Monitorear backpack/crud

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.6epss 0.9%
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, HasUploadFields methods uploadFileToDisk and uploadMultipleFilesToDisk, used through CrudTrait, and the withFiles() path through FileNameGenerator do not internally reject server-executable file types. An authenticated administrator can achieve remote code execution by using an upload-enabled CRUD field without mimes: and mimetypes: validation when the public disk is web-accessible through php artisan storage:link and the web-server and PHP-FPM configuration executes the stored extension. The legacy path preserves an accepted extension and the newer path derives an extension without blocking dangerous types. The package-level restriction is defense in depth and does not replace application-level upload validation. This issue is fixed in versions 6.8.14 and 7.0.38.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Laravel-Backpack · CRUD
CVEs relacionadas — Laravel-Backpack CRUD

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-54182HIGHbackpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)EPSS 0.8%CVE-2026-54176MEDIUMbackpack/crud: MyAccountController allows changing the login email without a current-password checkEPSS 0.7%CVE-2026-54178HIGHbackpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDiskEPSS 0.6%CVE-2026-54175HIGHbackpack/crud: Unverified password change in MyAccountController via mass assignmentEPSS 0.6%CVE-2026-54180HIGHbackpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)EPSS 0.5%CVE-2026-57570MEDIUMbackpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelationEPSS 0.4%