Vulnerability · Published Sep 14, 2026 · Assigned by GitHub_M
CVE-2026-54182backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
High 8.1
In plain English
A high-severity improper input validation in CRUD from Laravel-Backpack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | backpack/crud | 4.1.72 | GHSA-mrc5-3mm3-45c5 |
| Packagist | backpack/crud | 5.6.2 | GHSA-mrc5-3mm3-45c5 |
| Packagist | backpack/crud | 6.8.13 | GHSA-mrc5-3mm3-45c5 |
| Packagist | backpack/crud | 7.0.36 | GHSA-mrc5-3mm3-45c5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Laravel-Backpack | CRUD | < 4.1.70>= 5.0.0, < 5.6.2>= 6.0.0, < 6.8.13>= 7.0.0, < 7.0.36 |
Weakness: CWE-20, CWE-78, CWE-116 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5 x_refsource_CONFIRM
- https://github.com/Laravel-Backpack/CRUD/pull/6012 x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0 x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601 x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72 x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2 x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13 x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36 x_refsource_MISC