laravel-backpack/crud Security Advisories | GitStock

medium2026-08-20

Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

GHSA-42vx-43vc-x6pr · CVE-2026-57570

high2026-08-20

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

GHSA-mrc5-3mm3-45c5 · CVE-2026-54182

medium2026-08-20

Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

GHSA-mmg4-322v-6jvc · CVE-2026-54181

high2026-08-20

Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

GHSA-vgmv-8xjc-6rch · CVE-2026-54180

medium2026-08-20

Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

GHSA-8hw4-7qjr-3wxg · CVE-2026-54179

high2026-08-20

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

GHSA-8xjm-wqrp-2f25 · CVE-2026-54178

medium2026-08-20

Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

GHSA-8q2w-pv9p-mjvc · CVE-2026-54177

medium2026-08-20

Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

GHSA-9fw9-8c49-qch8 · CVE-2026-54176

high2026-08-20

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

GHSA-xpv2-hrfc-hw62 · CVE-2026-54175

medium2026-06-03

backpack/crud is vulnerable to Cross-Site Scripting (XSS)

GHSA-m8xx-3x29-84h8 · CVE-2022-31114

medium2022-05-24

Backpack\CRUD for Laravel XSS Vulnerability

GHSA-6gfm-gpr3-8wh9 · CVE-2018-20962