RCE in Laravel-Backpack Crud
CVE-2026-54182
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Laravel-Backpack Crud — versions < 4.1.70, >= 5.0.0, < 5.6.2, >= 6.0.0, < 6.8.13
Weakness classification (CWE)
References
- github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5
- github.com/Laravel-Backpack/CRUD/pull/6012
- github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c
- github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a
- github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0
- github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601
- github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72
- github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2
- github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13
- github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36
Frequently asked questions
- What is CVE-2026-54182?
- CVE-2026-54182 is a high-severity vulnerability in Laravel-Backpack Crud, classified under Improper Input Validation. CVSS score: 8.1/10. Published 2026-09-14.
- How severe is CVE-2026-54182?
- High severity. CVSS v3 base score is 8.1 out of 10.