CVE-2026-54177

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, HasUploadFields methods uploadFileToDisk and uploadMultipleFilesToDisk, used through CrudTrait, and the withFiles() path through FileNameGenerator do not internally reject server-executable file types. An authenticated administrator can achieve remote code execution by using an upload-enabled CRUD field without mimes: and mimetypes: validation when the public disk is web-accessible through php artisan storage:link and the web-server and PHP-FPM configuration executes the stored extension. The legacy path preserves an accepted extension and the newer path derives an extension without blocking dangerous types. The package-level restriction is defense in depth and does not replace application-level upload validation. This issue is fixed in versions 6.8.14 and 7.0.38.

• CWE-434

• https://github.com/Laravel-Backpack/CRUD/commit/5c5de0af242619d0653c7c70c900cd15b1a197c5
• https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969
• https://github.com/Laravel-Backpack/CRUD/pull/5993
• https://github.com/Laravel-Backpack/CRUD/pull/5994
• https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14
• https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38
• https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8q2w-pv9p-mjvc

Published

Sep 14, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54168Pipelines-as-Code is a CI/CD system that lets users define T…6.5
• CVE-2026-5417A vulnerability was determined in Dataease SQLbot up to 1.6.…4.7
• CVE-2026-54171Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.…6.5
• CVE-2026-54174melange allows users to build apk packages using declarative…8.3
• CVE-2026-54175backpack/crud provides Create, Read, Update & Delete (CRUD) …7.6
• CVE-2026-54176backpack/crud provides Create, Read, Update & Delete (CRUD) …6.5
• CVE-2026-54178backpack/crud provides Create, Read, Update & Delete (CRUD) …8.1
• CVE-2026-54179backpack/crud provides Create, Read, Update & Delete (CRUD) …4.4
• CVE-2026-5418A vulnerability was identified in appsmithorg appsmith up to…7.3
• CVE-2026-54180backpack/crud provides Create, Read, Update & Delete (CRUD) …7.6
• CVE-2026-54181backpack/crud provides Create, Read, Update & Delete (CRUD) …5.4
• CVE-2026-54182backpack/crud provides Create, Read, Update & Delete (CRUD) …8.1