Read the docs
TI-2022-13158 Aliases CVE-2022-31114GHSA-m8xx-3x29-84h8

backpack/crud Vulnerable to Cross-site Scripting

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions prior to 5.0.13, 4.1.69, and 4.0.63 are vulnerable to cross-site scripting. An attacker could conduct a targeted phishing campaign, in order to trick users or admins into clicking a malicious link, which under very specific circumstances could give them information or possibly admin access. Versions 5.0.13, 4.1.69, and 4.0.63 patch the issue. As a workaround, manually look inside error views in `resources/views/errors` and output `e($exception->getMessage())` instead of `$exception->getMessage()`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00303 23rd percentileScored 2026-11-07
Fix Fixed CRUD (Laravel-Backpack): 5.0.13, 4.1.69, 4.0.63backpack/crud (Packagist): 5.0.13, 4.1.69, 4.0.63

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Laravel-BackpackCRUD5.0.0 to before 5.0.13; 4.0.0 to before 4.1.69; before 4.0.635.0.13, 4.1.69, 4.0.63Patch availableCNA
—backpack/crud (Packagist)5.0.0 to before 5.0.135.0.13Patch availableGHSA-m8xx-3x29-84h8
—backpack/crud (Packagist)4.1.0 to before 4.1.694.1.69Patch availableGHSA-m8xx-3x29-84h8
—backpack/crud (Packagist)before 4.0.634.0.63Patch availableGHSA-m8xx-3x29-84h8
  • CRUD VendorLaravel-Backpack Affected 5.0.0 to before 5.0.13; 4.0.0 to before 4.1.69; before 4.0.63 Fixed in 5.0.13, 4.1.69, 4.0.63 Patch available CNA
  • backpack/crud (Packagist) Vendor— Affected 5.0.0 to before 5.0.13 Fixed in 5.0.13 Patch available GHSA-m8xx-3x29-84h8
  • backpack/crud (Packagist) Vendor— Affected 4.1.0 to before 4.1.69 Fixed in 4.1.69 Patch available GHSA-m8xx-3x29-84h8
  • backpack/crud (Packagist) Vendor— Affected before 4.0.63 Fixed in 4.0.63 Patch available GHSA-m8xx-3x29-84h8

Remediation

  • Fix · CNA CRUD (Laravel-Backpack) Fixed in 5.0.13, 4.1.69, 4.0.63
  • Fix · GHSA-m8xx-3x29-84h8 backpack/crud (Packagist) Fixed in 5.0.13 Advisory →
  • Fix · GHSA-m8xx-3x29-84h8 backpack/crud (Packagist) Fixed in 4.1.69 Advisory →
  • Fix · GHSA-m8xx-3x29-84h8 backpack/crud (Packagist) Fixed in 4.0.63 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31114
  2. 2026-10-03 Alias added: GHSA-m8xx-3x29-84h8

References

Advisory 1

Other 3

  • TI-2026-39086 backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) CVSS 3.1HIGH 8.1
  • TI-2026-39082 Path traversal in Laravel-Backpack CRUD CVSS 3.1HIGH 8.1
  • TI-2026-39084 backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) CVSS 3.1HIGH 7.6
  • TI-2026-39079 backpack/crud: Unverified password change in MyAccountController via mass assignment CVSS 3.1HIGH 7.6
  • TI-2026-39081 Unrestricted file upload in Laravel-Backpack CRUD CVSS 3.1MEDIUM 6.6
  • TI-2026-39080 backpack/crud: MyAccountController allows changing the login email without a current-password check CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences