Vulnerability-Lookup

CVE-2026-54179 (GCVE-0-2026-54179)

Vulnerability from cvelistv5 – Published: 2026-08-31 20:09 – Updated: 2026-09-01 14:59

Title

backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Summary

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 14:15 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/Laravel-Backpack/CRUD/security…	x_refsource_CONFIRM
https://github.com/Laravel-Backpack/CRUD/pull/5989	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/1…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Laravel-Backpack	CRUD	Affected: >= 6.0.0, < 6.8.14 Affected: >= 7.0.0, < 7.0.38	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54179",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T14:15:07.732998Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T14:59:11.540Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.8.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.38"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T20:09:50.087Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/5989",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/5989"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
        }
      ],
      "source": {
        "advisory": "GHSA-8hw4-7qjr-3wxg",
        "discovery": "UNKNOWN"
      },
      "title": "backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix \u2014 SVG-with-script lands on the public disk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54179",
    "datePublished": "2026-08-31T20:09:50.087Z",
    "dateReserved": "2026-06-11T21:46:52.382Z",
    "dateUpdated": "2026-09-01T14:59:11.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54179",
      "date": "2026-09-02",
      "epss": "0.00203",
      "percentile": "0.10233"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54179\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-31T21:17:09.670\",\"lastModified\":\"2026-09-01T15:17:20.487\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Laravel-Backpack\",\"product\":\"CRUD\",\"versions\":[{\"version\":\"\u003e= 6.0.0, \u003c 6.8.14\",\"status\":\"affected\"},{\"version\":\"\u003e= 7.0.0, \u003c 7.0.38\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.3,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-01T14:15:07.732998Z\",\"id\":\"CVE-2026-54179\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"},{\"lang\":\"en\",\"value\":\"CWE-434\"}]}],\"references\":[{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/pull/5989\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54179\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-01T14:15:07.732998Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-01T14:14:33.875Z\"}}], \"cna\": {\"title\": \"backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix \\u2014 SVG-with-script lands on the public disk\", \"source\": {\"advisory\": \"GHSA-8hw4-7qjr-3wxg\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"Laravel-Backpack\", \"product\": \"CRUD\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 6.0.0, \u003c 6.8.14\"}, {\"status\": \"affected\", \"version\": \"\u003e= 7.0.0, \u003c 7.0.38\"}]}], \"references\": [{\"url\": \"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/pull/5989\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/pull/5989\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-434\", \"description\": \"CWE-434: Unrestricted Upload of File with Dangerous Type\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-31T20:09:50.087Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54179\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-01T14:59:11.540Z\", \"dateReserved\": \"2026-06-11T21:46:52.382Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-31T20:09:50.087Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54179

Vulnerability from fkie_nvd - Published: 2026-08-31 21:17 - Updated: 2026-09-01 15:17

Severity

4.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/pull/5989
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.8.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.38"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14."
    }
  ],
  "id": "CVE-2026-54179",
  "lastModified": "2026-09-01T15:17:20.487",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54179",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-01T14:15:07.732998Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-31T21:17:09.670",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5989"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8HW4-7QJR-3WXG

Vulnerability from github – Published: 2026-08-20 18:38 – Updated: 2026-08-20 18:38

Summary

Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Details

Summary

SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles() — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the stored file to receive an extensionless filename, because mime_content_type() returns false when given a data URI instead of a filesystem path.

The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension.

Details

// src/app/Library/Uploaders/SingleBase64Image.php
if (Str::startsWith($value, 'data:image')) {
    // MIME subtype and decoded bytes are not validated
    $base64Image = Str::after($value, ';base64,');
    $finalPath   = $this->getPath() . $this->getFileName($value);
    Storage::disk($this->getDisk())->put($finalPath, base64_decode($base64Image));
    return $finalPath;
}

// src/app/Library/Uploaders/Support/FileNameGenerator.php
private function getExtensionFromFile(string|UploadedFile $file): string
{
    return is_a($file, UploadedFile::class, true)
        ? $file->extension()
        : Str::after(mime_content_type($file), '/'); // returns false on data URIs → empty string
}

The stored filename ends with a trailing dot and no extension.

Impact

An authenticated admin submitting a malicious payload to a Backpack image field stored with withFiles() can write arbitrary file content to the configured storage disk. Depending on server configuration and how stored files are served, this may lead to stored XSS or other unintended behavior when the file is later accessed.

Fix

The fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with finfo before storing. The extension is derived from the detected MIME type rather than the data URI string. Applied in SingleBase64Image::uploadFiles and uploadRepeatableFiles; FileNameGenerator::getExtensionFromFile now rejects inputs that produce an empty extension.

Setting X-Content-Type-Options: nosniff on admin responses is a useful defense-in-depth complement.

Affected versions

>= 6.0.0, < 6.8.14
>= 7.0.0, < 7.0.38

Patched versions

6.8.14
7.0.38

Severity

4.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.8.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.38"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54179"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:38:43Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`SingleBase64Image::uploadFiles` \u2014 the uploader bound to `image`-typed fields via `withFiles()` \u2014 only verifies that the submitted value starts with the string `data:image`. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in `FileNameGenerator` causes the stored file to receive an extensionless filename, because `mime_content_type()` returns `false` when given a data URI instead of a filesystem path.\n\nThe combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension.\n\n### Details\n\n```php\n// src/app/Library/Uploaders/SingleBase64Image.php\nif (Str::startsWith($value, \u0027data:image\u0027)) {\n    // MIME subtype and decoded bytes are not validated\n    $base64Image = Str::after($value, \u0027;base64,\u0027);\n    $finalPath   = $this-\u003egetPath() . $this-\u003egetFileName($value);\n    Storage::disk($this-\u003egetDisk())-\u003eput($finalPath, base64_decode($base64Image));\n    return $finalPath;\n}\n\n// src/app/Library/Uploaders/Support/FileNameGenerator.php\nprivate function getExtensionFromFile(string|UploadedFile $file): string\n{\n    return is_a($file, UploadedFile::class, true)\n        ? $file-\u003eextension()\n        : Str::after(mime_content_type($file), \u0027/\u0027); // returns false on data URIs \u2192 empty string\n}\n```\n\nThe stored filename ends with a trailing dot and no extension.\n\n### Impact\n\nAn authenticated admin submitting a malicious payload to a Backpack `image` field stored with `withFiles()` can write arbitrary file content to the configured storage disk. Depending on server configuration and how stored files are served, this may lead to stored XSS or other unintended behavior when the file is later accessed.\n\n### Fix\n\nThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with `finfo` before storing. The extension is derived from the detected MIME type rather than the data URI string. Applied in `SingleBase64Image::uploadFiles` and `uploadRepeatableFiles`; `FileNameGenerator::getExtensionFromFile` now rejects inputs that produce an empty extension.\n\nSetting `X-Content-Type-Options: nosniff` on admin responses is a useful defense-in-depth complement.\n\n### Affected versions\n\n- `\u003e= 6.0.0, \u003c 6.8.14`\n- `\u003e= 7.0.0, \u003c 7.0.38`\n\n### Patched versions\n\n- `6.8.14`\n- `7.0.38`",
  "id": "GHSA-8hw4-7qjr-3wxg",
  "modified": "2026-08-20T18:38:43Z",
  "published": "2026-08-20T18:38:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix \u2014 SVG-with-script lands on the public disk"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54179 (GCVE-0-2026-54179)

FKIE_CVE-2026-54179

GHSA-8HW4-7QJR-3WXG

Summary

Details

Impact

Fix

Affected versions

Patched versions

Tags

Sightings

Nomenclature