Arbitrary File Upload Affecting backpack/crud package, versions >=6.0.0, <6.8.14>=7.0.0, <7.0.38
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-BACKPACKCRUD-19428001
- published29 Aug 2026
- disclosed20 Aug 2026
- creditUnknown
Introduced: 20 Aug 2026
NewCVE-2026-54179 (opens in a new tab)How to fix?
Upgrade backpack/crud to version 6.8.14, 7.0.38 or higher.
Overview
backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5
Affected versions of this package are vulnerable to Arbitrary File Upload via the SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles() — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the stored file to receive an extensionless filename, because mime_content_type() returns false when given a data URI instead of a filesystem path.