backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Laravel-Backpack | CRUD | before 4.1.70; 5.0.0 to before 5.6.2; 6.0.0 to before 6.8.13; 7.0.0 to before 7.0.36 | 4.1.70, 5.6.2, 6.8.13, 7.0.36 | Patch available | CNA |
| — | backpack/crud (Packagist) | 4.1.0 to before 4.1.72 | 4.1.72 | Patch available | GHSA-mrc5-3mm3-45c5 |
| — | backpack/crud (Packagist) | 5.0.0 to before 5.6.2 | 5.6.2 | Patch available | GHSA-mrc5-3mm3-45c5 |
| — | backpack/crud (Packagist) | 6.0.0 to before 6.8.13 | 6.8.13 | Patch available | GHSA-mrc5-3mm3-45c5 |
| — | backpack/crud (Packagist) | 7.0.0 to before 7.0.36 | 7.0.36 | Patch available | GHSA-mrc5-3mm3-45c5 |
- CRUD VendorLaravel-Backpack Affected before 4.1.70; 5.0.0 to before 5.6.2; 6.0.0 to before 6.8.13; 7.0.0 to before 7.0.36 Fixed in 4.1.70, 5.6.2, 6.8.13, 7.0.36 Patch available CNA
- backpack/crud (Packagist) Vendor— Affected 4.1.0 to before 4.1.72 Fixed in 4.1.72 Patch available GHSA-mrc5-3mm3-45c5
- backpack/crud (Packagist) Vendor— Affected 5.0.0 to before 5.6.2 Fixed in 5.6.2 Patch available GHSA-mrc5-3mm3-45c5
- backpack/crud (Packagist) Vendor— Affected 6.0.0 to before 6.8.13 Fixed in 6.8.13 Patch available GHSA-mrc5-3mm3-45c5
- backpack/crud (Packagist) Vendor— Affected 7.0.0 to before 7.0.36 Fixed in 7.0.36 Patch available GHSA-mrc5-3mm3-45c5
Remediation
- Fix · CNA CRUD (Laravel-Backpack) Fixed in 4.1.70, 5.6.2, 6.8.13, 7.0.36
- Fix · GHSA-mrc5-3mm3-45c5 backpack/crud (Packagist) Fixed in 4.1.72 Advisory →
- Fix · GHSA-mrc5-3mm3-45c5 backpack/crud (Packagist) Fixed in 5.6.2 Advisory →
- Fix · GHSA-mrc5-3mm3-45c5 backpack/crud (Packagist) Fixed in 6.8.13 Advisory →
- Fix · GHSA-mrc5-3mm3-45c5 backpack/crud (Packagist) Fixed in 7.0.36 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54182
- 2026-10-03 Alias added: GHSA-mrc5-3mm3-45c5
References
Other 11
- https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5
- https://github.com/Laravel-Backpack/CRUD/pull/6012
- https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c
- https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a
- https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0
- https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601
- https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72
- https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2
- https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13
- https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36
- https://github.com/Laravel-Backpack/CRUD
More Laravel-Backpack vulnerabilities
- TI-2026-39082 Path traversal in Laravel-Backpack CRUD CVSS 3.1HIGH 8.1
- TI-2026-39084 backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) CVSS 3.1HIGH 7.6
- TI-2026-39079 backpack/crud: Unverified password change in MyAccountController via mass assignment CVSS 3.1HIGH 7.6
- TI-2026-39081 Unrestricted file upload in Laravel-Backpack CRUD CVSS 3.1MEDIUM 6.6
- TI-2026-39080 backpack/crud: MyAccountController allows changing the login email without a current-password check CVSS 3.1MEDIUM 6.5
- TI-2026-41421 backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-54182 · CVE Program
- CVE-2026-54182 · NVD
- FIRST EPSS
- GHSA-mrc5-3mm3-45c5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences