Backpack/CrUD CVE-2025-54177: RCE via public-disk file upload

Vulnerability Summary: HasUploadFields Retains Attacker-Provided File Extension Vulnerability Overview Vulnerability Name: HasUploadFields retains attacker-provided file extensions — a uploaded to the public-disk is reachable by the web server Severity: Moderate (CVSS v3.1 Score 6.0 / 10) CVE ID: CVE-2025-54177 CWE: CWE-434 (Unrestricted File Upload) Reporter: Vitali Shulda (@shulda30) via sechub.dev Release Date: June 15, 2025 Affected Scope Affected Package: (Composer) Affected Versions: - - Fixed Versions: - - Technical Details (used on models managed by Backpack via ) and the uploader retain the file extension provided by the client without validation. In environments where a disk is configured and has been executed, an authenticated administrator can upload a file with a server-executable extension (such as ), which will be handed over to the PHP interpreter (when no MIME or other type-based upload validation is in place). The and methods hash the file name stem, but write the client-provided extension verbatim into the disk path — without any allowlist, blocklist, or MIME checks. The path (via ) resolves the extension from the file's own MIME type rather than the client-provided filename, but it also does not block server-executable types. Exploitation Prerequisites An authenticated administrator with access to the Backpack CRUD panel An upload field without / validation rules A site using the disk (standard mode for web-visible uploads) has been executed A web server + PHP-FPM stack (default configuration on most hosts) Impact An authenticated administrator, on a site meeting the above conditions, can upload a server-executable file and achieve Remote Code Execution (RCE). Remediation A denylist of server-executable extensions has been added in and . Image upload fields additionally enforce an allowlist. This fix is defense-in-depth and does not replace application-layer validation. Recommended Actions for Developers Review all upload fields and add explicit or validation rules. Refer to the examples in the Backpack fields documentation.

Goal Reached Thanks to every supporter — we hit 100%!

Backpack/CrUD CVE-2025-54177: RCE via public-disk file upload

More from this source