CVE-2026-54178
1 advisory.
Packagist/backpack/crud CVE-2026-54178: high 8.1
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
Action: Upgrade backpack/crud to 6.8.12 or later.
composer require backpack/crud:6.8.12composer require backpack/crud:7.0.35Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | - | - |
| 6.0.0 | 6.8.12 | - |
| 7.0.0 | 7.0.35 | - |
Fixed versions
| 6.8.12 | 7.0.35 |
Sources
- osv: GHSA-8xjm-wqrp-2f25
- https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8xjm-wqrp-2f25
- https://github.com/Laravel-Backpack/CRUD
- https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.12
- https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.35
CVE-2026-54178 · published · modified · JSON