Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Laravel-Backpack — Vulnerabilities & Security Advisories 11

Browse all 11 CVE security advisories affecting Laravel-Backpack. AI-powered Chinese analysis, POCs, and references for each vulnerability.

This page provides a centralized view of known vulnerabilities associated with the Laravel Backpack CMS application, categorized under the weakness type of general software flaws and tagged for easy filtering. It aggregates a comprehensive list of security issues, including but not limited to cross-site scripting, authentication bypasses, and privilege escalation bugs, covering a wide time range from early releases to the most recent patches. By using this resource, users can track a vendor's advisory history to stay informed about critical fixes, understand specific weakness classes to assess risk exposure in their own deployments, and look up a product's vulnerability history to evaluate the long-term security posture of the software. This data is intended for security professionals, developers, and system administrators who need to quickly identify if their installations are affected by documented exploits. The information is structured to help teams prioritize remediation efforts by highlighting the severity and impact of each flaw. Instead of providing immediate fixes, this page serves as an intelligence hub for understanding the landscape of threats facing the Laravel Backpack ecosystem. Readers are encouraged to cross-reference these entries with official vendor announcements for the most accurate mitigation strategies. The goal is to enhance visibility and accountability regarding the security of this popular content management tool. Maintaining up-to-date knowledge of these vulnerabilities is essential for protecting web applications that rely on this framework.

Top products by Laravel-Backpack: CRUD FileManager
CVE ID Title CVSS Severity Published
CVE-2026-54181 backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted — CRUD CWE-79 5.4 Medium 2026-09-14
CVE-2026-54177 backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver — CRUD CWE-434 6.6 Medium 2026-09-14
CVE-2026-54176 backpack/crud: MyAccountController allows changing the login email without a current-password check — CRUD CWE-287 6.5 Medium 2026-09-14
CVE-2026-54180 backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) — CRUD CWE-639 7.6 High 2026-09-14
CVE-2026-57570 backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation — CRUD CWE-862 6.5 Medium 2026-09-14
CVE-2026-54178 backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk — CRUD CWE-22 8.1 High 2026-09-14
CVE-2026-54182 backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) — CRUD CWE-20 8.1 High 2026-09-14
CVE-2026-54175 backpack/crud: Unverified password change in MyAccountController via mass assignment — CRUD CWE-620 7.6 High 2026-09-14
CVE-2026-54179 backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk — CRUD CWE-79 4.4 Medium 2026-08-31
CVE-2022-31114 backpack/crud Vulnerable to Cross-site Scripting — CRUD CWE-79 - - 2026-06-03
CVE-2024-52306 FileManager Deserialization of Untrusted Data — FileManager CWE-502 7.7 High 2024-11-13

This page lists every published CVE security advisory associated with Laravel-Backpack. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.