Arbitrary File Upload Affecting backpack/crud package, versions >=6.0.0, <6.8.14>=7.0.0, <7.0.38
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-BACKPACKCRUD-19427970
- published29 Aug 2026
- disclosed20 Aug 2026
- creditUnknown
Introduced: 20 Aug 2026
NewCVE-2026-54177 (opens in a new tab)How to fix?
Upgrade backpack/crud to version 6.8.14, 7.0.38 or higher.
Overview
backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5
Affected versions of this package are vulnerable to Arbitrary File Upload via the HasUploadFields process. An attacker can execute arbitrary code on the server by uploading a file with a server-executable extension through an upload-enabled panel. This is only exploitable if the attacker has authenticated administrator access, the upload field lacks MIME type validation, the public disk is used, php artisan storage:link is in place, and the web server is configured with PHP-FPM.