CVE-2026-54177
1 advisory.
Packagist/backpack/crud CVE-2026-54177: medium 6.6
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
Action: Upgrade backpack/crud to 6.8.14 or later.
composer require backpack/crud:6.8.14composer require backpack/crud:7.0.38Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.8.14 | - |
| 7.0.0 | 7.0.38 | - |
Fixed versions
| 6.8.14 | 7.0.38 |
Sources
- osv: GHSA-8q2w-pv9p-mjvc
- https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8q2w-pv9p-mjvc
- https://github.com/Laravel-Backpack/CRUD/pull/5993
- https://github.com/Laravel-Backpack/CRUD
- https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14
- https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38
CVE-2026-54177 · published · modified · JSON