CVE-2026-54177

backpack/crud from version 6.0.0 to 6.8.15 and 7.0.47 contains a vulnerability in HasMany and MorphMany handling through attachManyRelation during CRUD create and update operations. The vulnerability allows an authenticated low-privilege administrator to modify unrelated child records, including reassigning, detaching, nulling, or deleting them, even across ownership or tenant boundaries. This requires that the records should not be attachable or removable by that administrator and the absence of additional application-level authorization.

In backpack/crud before 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest builds a shell command with a URL influenced by the HTTP Host header and passes it to exec() without adequate shell neutralization. An unauthenticated attacker can inject OS commands when exec() and curl are available and the 1-in-100 random gate is reached (repeated requests can hit it). Successful exploitation executes commands as the web-server user.

From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branches controlled by $column['escaped'], which defaults to true, causing $column['text'] to be rendered unescaped by default. An attacker who can store an unsanitized value in a color column can execute script in the browser of a user who views the CRUD list, including an administrator.

In backpack/crud from 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query instead of the query configured through addClause() or addBaseClause(). An authenticated user who knows or guesses an out-of-scope record primary key can modify, delete, or reorder records hidden by tenant, ownership, or other row-level access-control scopes.

In backpack/crud before 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk trusts disk-relative paths from clear_<attribute>[] and passes them to Storage::disk()->delete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator can delete another record's attachment, a shared asset, or another operational file on the configured disk.

From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow.

In backpack/crud before 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can mass-assign password, the authentication column, or other deployment-specific fillable attributes.

backpack/crud provides CRUD functions for Backpack, a Laravel package collection. From 6.0.0 until 6.8.14 and 7.0.37, the methods SingleBase64Image::uploadFiles and uploadRepeatableFiles accept any data URI starting with data:image without validating MIME subtype or decoded bytes. An authenticated administrator can store arbitrary file content under an extensionless filename, which can cause stored XSS or other unintended behavior.

Cross-site scripting vulnerability in backpack/crud for Laravel. An attacker can conduct a targeted phishing campaign to trick users or admins into clicking a malicious link, which under very specific circumstances could lead to information disclosure or admin access.