Laravel-Backpack CRUD versions >=6.0.0 <6.8.14 and >=7.0.0 <7.0.38 contain a vulnerability (CWE-434) where the HasUploadFields methods uploadFileToDisk and uploadMultipleFilesToDisk, as well as the withFiles() path through FileNameGenerator, do not internally block server-executable file types. When used with an upload-enabled CRUD field lacking mimes: and mimetypes: validation, and when the public disk is web-accessible via php artisan storage:link with a web server and PHP-FPM configuration that executes stored extensions, an authenticated administrator can achieve remote code execution. The package-level restriction is intended as defense in depth and does not replace application-level validation. The issue is resolved in versions 6.8.14 and 7.0.38.

An authenticated administrator can exploit this vulnerability to upload files with dangerous extensions that the web server may execute, leading to remote code execution. This compromises confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score is 6.6 (medium severity) with network attack vector, high attack complexity, required privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Upgrade Laravel-Backpack CRUD to version 6.8.14 or later, or 7.0.38 or later, where this vulnerability is fixed. Additionally, ensure application-level upload validation is implemented using mimes: and mimetypes: rules to restrict dangerous file types. Avoid relying solely on package-level restrictions. Verify that the public disk is not web-accessible or that the web server and PHP-FPM configurations do not execute uploaded files with dangerous extensions.