---
id: CVE-2026-54177
title: >-
  backpack/crud provides Create, Read, Update & Delete (CRUD) functions for
  Backpack, a collection of Laravel packages that help users build custom
  administration panels
summary: >-
  backpack/crud provides Create, Read, Update & Delete (CRUD) functions for
  Backpack, a collection of Laravel packages that help users build custom
  administration panels. From 6.0.0 until 6.8.14 and 7.0.38, HasUploadFields
  methods uploadFi…
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-434
vendor: Laravel-Backpack
product: CRUD
affected:
  - 'CRUD >= 6.0.0, < 6.8.14'
  - 'CRUD >= 7.0.0, < 7.0.38'
patched:
  - backpack/crud 6.8.14
  - backpack/crud 7.0.38
published: '2026-09-14'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T17:17:20.323'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54177'
references:
  - url: >-
      https://github.com/Laravel-Backpack/CRUD/commit/5c5de0af242619d0653c7c70c900cd15b1a197c5
    label: security-advisories@github.com
  - url: >-
      https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/pull/5993'
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/pull/5994'
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14'
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8q2w-pv9p-mjvc
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-8q2w-pv9p-mjvc'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
epss: 0.0093
epssPercentile: 0.58958
aliases:
  - GHSA-8q2w-pv9p-mjvc
ecosystem: composer
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-16T16:06:34.718018Z'
ingestedAt: '2026-08-20T18:59:54.880Z'
---

## Overview

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, HasUploadFields methods uploadFileToDisk and uploadMultipleFilesToDisk, used through CrudTrait, and the withFiles() path through FileNameGenerator do not internally reject server-executable file types. An authenticated administrator can achieve remote code execution by using an upload-enabled CRUD field without mimes: and mimetypes: validation when the public disk is web-accessible through php artisan storage:link and the web-server and PHP-FPM configuration executes the stored extension. The legacy path preserves an accepted extension and the newer path derives an extension without blocking dangerous types. The package-level restriction is defense in depth and does not replace application-level upload validation. This issue is fixed in versions 6.8.14 and 7.0.38.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54177)

Affected packages:

- `backpack/crud >= 6.0.0, < 6.8.14`
- `backpack/crud >= 7.0.0, < 7.0.38`

Patched in:

- `backpack/crud 6.8.14`
- `backpack/crud 7.0.38`

Source: https://github.com/advisories/GHSA-8q2w-pv9p-mjvc