Search
Find a vulnerability
Search criteria
6 vulnerabilities by Laravel-Backpack
CVE-2026-54179 (GCVE-0-2026-54179)
Vulnerability from nvd – Published: 2026-08-31 20:09 – Updated: 2026-09-01 14:59
VLAI
EPSS
VEX
Title
backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Summary
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 14:15 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Laravel-Backpack/CRUD/security… | x_refsource_CONFIRM |
| https://github.com/Laravel-Backpack/CRUD/pull/5989 | x_refsource_MISC |
| https://github.com/Laravel-Backpack/CRUD/commit/1… | x_refsource_MISC |
| https://github.com/Laravel-Backpack/CRUD/releases… | x_refsource_MISC |
| https://github.com/Laravel-Backpack/CRUD/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Laravel-Backpack | CRUD |
Affected:
>= 6.0.0, < 6.8.14
Affected: >= 7.0.0, < 7.0.38 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54179",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T14:15:07.732998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T14:59:11.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CRUD",
"vendor": "Laravel-Backpack",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.8.14"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 7.0.38"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T20:09:50.087Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg"
},
{
"name": "https://github.com/Laravel-Backpack/CRUD/pull/5989",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Laravel-Backpack/CRUD/pull/5989"
},
{
"name": "https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751"
},
{
"name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
},
{
"name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
}
],
"source": {
"advisory": "GHSA-8hw4-7qjr-3wxg",
"discovery": "UNKNOWN"
},
"title": "backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix \u2014 SVG-with-script lands on the public disk"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54179",
"datePublished": "2026-08-31T20:09:50.087Z",
"dateReserved": "2026-06-11T21:46:52.382Z",
"dateUpdated": "2026-09-01T14:59:11.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-31114 (GCVE-0-2022-31114)
Vulnerability from nvd – Published: 2026-06-03 14:41 – Updated: 2026-06-03 16:01
VLAI
EPSS
VEX
Title
backpack/crud Vulnerable to Cross-site Scripting
Summary
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions prior to 5.0.13, 4.1.69, and 4.0.63 are vulnerable to cross-site scripting. An attacker could conduct a targeted phishing campaign, in order to trick users or admins into clicking a malicious link, which under very specific circumstances could give them information or possibly admin access. Versions 5.0.13, 4.1.69, and 4.0.63 patch the issue. As a workaround, manually look inside error views in `resources/views/errors` and output `e($exception->getMessage())` instead of `$exception->getMessage()`.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-03 16:01 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Laravel-Backpack/CRUD/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Laravel-Backpack | CRUD |
Affected:
>= 5.0.0, < 5.0.13
Affected: >= 4.0.0, < 4.1.69 Affected: < 4.0.63 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-31114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T16:01:14.919643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T16:01:22.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CRUD",
"vendor": "Laravel-Backpack",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.0.13"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.1.69"
},
{
"status": "affected",
"version": "\u003c 4.0.63"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions prior to 5.0.13, 4.1.69, and 4.0.63 are vulnerable to cross-site scripting. An attacker could conduct a targeted phishing campaign, in order to trick users or admins into clicking a malicious link, which under very specific circumstances could give them information or possibly admin access. Versions 5.0.13, 4.1.69, and 4.0.63 patch the issue. As a workaround, manually look inside error views in `resources/views/errors` and output `e($exception-\u003egetMessage())` instead of `$exception-\u003egetMessage()`."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T14:41:41.395Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-m8xx-3x29-84h8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-m8xx-3x29-84h8"
}
],
"source": {
"advisory": "GHSA-m8xx-3x29-84h8",
"discovery": "UNKNOWN"
},
"title": "backpack/crud Vulnerable to Cross-site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-31114",
"datePublished": "2026-06-03T14:41:41.395Z",
"dateReserved": "2022-05-18T18:37:25.429Z",
"dateUpdated": "2026-06-03T16:01:22.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-52306 (GCVE-0-2024-52306)
Vulnerability from nvd – Published: 2024-11-13 15:15 – Updated: 2024-11-13 20:01
VLAI
EPSS
VEX
Title
FileManager Deserialization of Untrusted Data
Summary
FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-13 19:58 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Laravel-Backpack/FileManager/s… | x_refsource_CONFIRM |
| https://github.com/Laravel-Backpack/FileManager/c… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Laravel-Backpack | FileManager |
Affected:
< 3.0.9
|
|
| laravel-backpack | file_manager |
Affected:
0 , < 3.0.9
(custom)
cpe:2.3:a:laravel-backpack:file_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:laravel-backpack:file_manager:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "file_manager",
"vendor": "laravel-backpack",
"versions": [
{
"lessThan": "3.0.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-13T19:58:23.576021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T20:01:56.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FileManager",
"vendor": "Laravel-Backpack",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T15:15:38.301Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Laravel-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Laravel-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2"
},
{
"name": "https://github.com/Laravel-Backpack/FileManager/commit/2830498b85e05fb3c92179053b4d7c4a0fdb880b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Laravel-Backpack/FileManager/commit/2830498b85e05fb3c92179053b4d7c4a0fdb880b"
}
],
"source": {
"advisory": "GHSA-8237-957h-h2c2",
"discovery": "UNKNOWN"
},
"title": "FileManager Deserialization of Untrusted Data"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-52306",
"datePublished": "2024-11-13T15:15:38.301Z",
"dateReserved": "2024-11-06T19:00:26.397Z",
"dateUpdated": "2024-11-13T20:01:56.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-54179 (GCVE-0-2026-54179)
Vulnerability from cvelistv5 – Published: 2026-08-31 20:09 – Updated: 2026-09-01 14:59
VLAI
EPSS
VEX
Title
backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Summary
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 14:15 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Laravel-Backpack/CRUD/security… | x_refsource_CONFIRM |
| https://github.com/Laravel-Backpack/CRUD/pull/5989 | x_refsource_MISC |
| https://github.com/Laravel-Backpack/CRUD/commit/1… | x_refsource_MISC |
| https://github.com/Laravel-Backpack/CRUD/releases… | x_refsource_MISC |
| https://github.com/Laravel-Backpack/CRUD/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Laravel-Backpack | CRUD |
Affected:
>= 6.0.0, < 6.8.14
Affected: >= 7.0.0, < 7.0.38 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54179",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T14:15:07.732998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T14:59:11.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CRUD",
"vendor": "Laravel-Backpack",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.8.14"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 7.0.38"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T20:09:50.087Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg"
},
{
"name": "https://github.com/Laravel-Backpack/CRUD/pull/5989",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Laravel-Backpack/CRUD/pull/5989"
},
{
"name": "https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751"
},
{
"name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
},
{
"name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
}
],
"source": {
"advisory": "GHSA-8hw4-7qjr-3wxg",
"discovery": "UNKNOWN"
},
"title": "backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix \u2014 SVG-with-script lands on the public disk"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54179",
"datePublished": "2026-08-31T20:09:50.087Z",
"dateReserved": "2026-06-11T21:46:52.382Z",
"dateUpdated": "2026-09-01T14:59:11.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-31114 (GCVE-0-2022-31114)
Vulnerability from cvelistv5 – Published: 2026-06-03 14:41 – Updated: 2026-06-03 16:01
VLAI
EPSS
VEX
Title
backpack/crud Vulnerable to Cross-site Scripting
Summary
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions prior to 5.0.13, 4.1.69, and 4.0.63 are vulnerable to cross-site scripting. An attacker could conduct a targeted phishing campaign, in order to trick users or admins into clicking a malicious link, which under very specific circumstances could give them information or possibly admin access. Versions 5.0.13, 4.1.69, and 4.0.63 patch the issue. As a workaround, manually look inside error views in `resources/views/errors` and output `e($exception->getMessage())` instead of `$exception->getMessage()`.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-03 16:01 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Laravel-Backpack/CRUD/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Laravel-Backpack | CRUD |
Affected:
>= 5.0.0, < 5.0.13
Affected: >= 4.0.0, < 4.1.69 Affected: < 4.0.63 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-31114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T16:01:14.919643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T16:01:22.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CRUD",
"vendor": "Laravel-Backpack",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.0.13"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.1.69"
},
{
"status": "affected",
"version": "\u003c 4.0.63"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions prior to 5.0.13, 4.1.69, and 4.0.63 are vulnerable to cross-site scripting. An attacker could conduct a targeted phishing campaign, in order to trick users or admins into clicking a malicious link, which under very specific circumstances could give them information or possibly admin access. Versions 5.0.13, 4.1.69, and 4.0.63 patch the issue. As a workaround, manually look inside error views in `resources/views/errors` and output `e($exception-\u003egetMessage())` instead of `$exception-\u003egetMessage()`."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T14:41:41.395Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-m8xx-3x29-84h8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-m8xx-3x29-84h8"
}
],
"source": {
"advisory": "GHSA-m8xx-3x29-84h8",
"discovery": "UNKNOWN"
},
"title": "backpack/crud Vulnerable to Cross-site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-31114",
"datePublished": "2026-06-03T14:41:41.395Z",
"dateReserved": "2022-05-18T18:37:25.429Z",
"dateUpdated": "2026-06-03T16:01:22.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-52306 (GCVE-0-2024-52306)
Vulnerability from cvelistv5 – Published: 2024-11-13 15:15 – Updated: 2024-11-13 20:01
VLAI
EPSS
VEX
Title
FileManager Deserialization of Untrusted Data
Summary
FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-13 19:58 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Laravel-Backpack/FileManager/s… | x_refsource_CONFIRM |
| https://github.com/Laravel-Backpack/FileManager/c… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Laravel-Backpack | FileManager |
Affected:
< 3.0.9
|
|
| laravel-backpack | file_manager |
Affected:
0 , < 3.0.9
(custom)
cpe:2.3:a:laravel-backpack:file_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:laravel-backpack:file_manager:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "file_manager",
"vendor": "laravel-backpack",
"versions": [
{
"lessThan": "3.0.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-13T19:58:23.576021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T20:01:56.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FileManager",
"vendor": "Laravel-Backpack",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T15:15:38.301Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Laravel-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Laravel-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2"
},
{
"name": "https://github.com/Laravel-Backpack/FileManager/commit/2830498b85e05fb3c92179053b4d7c4a0fdb880b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Laravel-Backpack/FileManager/commit/2830498b85e05fb3c92179053b4d7c4a0fdb880b"
}
],
"source": {
"advisory": "GHSA-8237-957h-h2c2",
"discovery": "UNKNOWN"
},
"title": "FileManager Deserialization of Untrusted Data"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-52306",
"datePublished": "2024-11-13T15:15:38.301Z",
"dateReserved": "2024-11-06T19:00:26.397Z",
"dateUpdated": "2024-11-13T20:01:56.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}