GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-54182

Vulnerability from fkie_nvd - Published: 2026-09-14 18:17 - Updated: 2026-09-14 19:17
Severity
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.
References
security-advisories@github.comhttps://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c
security-advisories@github.comhttps://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a
security-advisories@github.comhttps://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0
security-advisories@github.comhttps://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601
security-advisories@github.comhttps://github.com/Laravel-Backpack/CRUD/pull/6012
security-advisories@github.comhttps://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72
security-advisories@github.comhttps://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2
security-advisories@github.comhttps://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13
security-advisories@github.comhttps://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36
security-advisories@github.comhttps://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.1.70"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.6.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.8.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.36"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\\CRUD\\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36."
    }
  ],
  "id": "CVE-2026-54182",
  "lastModified": "2026-09-14T19:17:30.167",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54182",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-14T18:17:38.848658Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T18:17:53.380",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/6012"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.