CVE-2026-54179: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Laravel-Backpack CRUD
Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.
CVSS v3.1
Score 4.4medium
Affected software
Laravel-Backpack
CRUD
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the backpack/crud package for Laravel-Backpack, specifically in the SingleBase64Image uploader methods (uploadFiles and uploadRepeatableFiles) that accept any data URI starting with 'data:image' without validating the MIME subtype or decoded content. Additionally, the FileNameGenerator::getExtensionFromFile method incorrectly applies mime_content_type() to the data URI string rather than the decoded file content. This flaw allows an authenticated administrator to store arbitrary content with an extensionless filename on the configured disk, potentially enabling stored cross-site scripting or other unintended behaviors when the file is accessed. The vulnerability is resolved in versions 6.8.14 and 7.0.38.
Potential Impact
An authenticated administrator can exploit this vulnerability to upload files containing arbitrary content without proper MIME validation, leading to stored cross-site scripting (XSS) attacks or other unintended behaviors when these files are served. This can compromise the confidentiality and integrity of the application data and potentially affect users accessing the stored files.
Mitigation Recommendations
This vulnerability is fixed in Laravel-Backpack CRUD versions 6.8.14 and 7.0.38. Users should upgrade to these or later versions to remediate the issue. No other mitigation or temporary workaround is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-11T21:46:52.382Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a95e2adacd9273b498b8ab7
Added to database: 08/31/2026, 20:23:09 UTC
Last enriched: 09/07/2026, 14:47:48 UTC
Last updated: 10/14/2026, 06:48:19 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.