backpack/crud
Build custom admin panels. Fast!
View on Github
Activity
- Latest release
- 1d ago
- Total releases
- 712
- Cadence
- ~daily
- Last 12 months
- 81
Reach
- Stars
- 3.4k
Details
- License
- MIT
- First release
- Jul 27, 2015
| Version | Released | |
|---|---|---|
7.1.16
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.15
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.14
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.13
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.12
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.11
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.10
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.9
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.8
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.7
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.6
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.5
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.4
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.3
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.2
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.1
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.1.0
minor
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.50
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.49
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
6.8.16
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.48
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
6.8.15
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.47
patch
1 CVE
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.46
patch
2 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.45
patch
2 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
4.1.72
patch
1 CVE
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.44
patch
2 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.43
patch
2 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.42
patch
2 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.41
patch
2 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.40
patch
2 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.39
patch
2 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
6.8.14
patch
2 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
7.0.38
patch
2 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev | ||
5.6.2
patch
2 CVEs
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev | ||
6.8.13
patch
7 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.37
patch
7 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.35
patch
8 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev | ||
6.8.12
patch
8 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.34
patch
8 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev | ||
6.8.11
patch
8 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.33
patch
9 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.32
patch
9 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.31
patch
9 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.30
patch
9 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.29
patch
9 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.28
patch
9 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.27
patch
9 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.26
patch
9 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev | ||
7.0.25
patch
9 CVEs
CVE-2026-57570
GHSA-42vx-43vc-x6pr
Aug 20, 2026
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
Vulnerability DetailsAffected area: HasMany / MorphMany relation handling during CRUD create and update operations SummaryBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field. Root CauseThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope. As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form. This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic. ImpactAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records. Possible impact includes:
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field. Affected ConditionsAn application may be affected when all of the following are true:
Recommended FixBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context. The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs. Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels. VerificationThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures. The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check. After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal. Affected versions
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
+ 156 more Show less
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
Fixed in
6.8.15
7.0.47
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54182
GHSA-mrc5-3mm3-45c5
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
8.1
/ 10
High
Network
High
None
None
Unchanged
High
High
High
Summary
The vulnerable code path is reached from SeverityHigh — CVSS 8.1 Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and ImpactA successful exploit yields OS command execution as the web server user ( Fix
Affected versions| Branch | Vulnerable range | First safe version |
|--------|-----------------|-------------------|
| 4.1.x | CreditsReported by Vishal Shukla (@shukla304) via sechub.dev AI Agent. Affected versions
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
+ 287 more Show less
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
4.1.72
5.6.2
6.8.13
7.0.36
References
Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54181
GHSA-mmg4-322v-6jvc
Aug 20, 2026
Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryThe Blade template for the DetailsAll other column templates in
The ImpactStored XSS with scope change (attacker context runs in victim's browser). Highest-risk target is an administrator viewing the list view. Exploitability requires the ability to write an unsanitized value into a PatchesFixed in 6.8.14 and 7.0.38 by correcting the branch order in WorkaroundsValidate stored color values against a strict CSS color grammar (e.g. CreditsReported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54180
GHSA-vgmv-8xjc-6rch
Aug 20, 2026
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryBackpack CRUD's list and read operations correctly apply any query scopes
registered via An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on ImpactAny Backpack CRUD panel that uses PatchesApply the fixed release for your major version:
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. WorkaroundsIf you cannot upgrade immediately, add explicit CreditsReported by Vishal Shukla (@shukla304). Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54179
GHSA-8hw4-7qjr-3wxg
Aug 20, 2026
Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
4.4
/ 10
Medium
Network
High
Low
Required
Changed
Low
Low
None
Summary
The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension. DetailsThe stored filename ends with a trailing dot and no extension. ImpactAn authenticated admin submitting a malicious payload to a Backpack FixThe fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with Setting Affected versions
Patched versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54178
GHSA-8xjm-wqrp-2f25
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
8.1
/ 10
High
Network
Low
Low
None
Unchanged
None
High
High
Summary
An authenticated user with Update access on any CRUD that wires The safe pattern already exists in the codebase: Affected code
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases. ImpactAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted). CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) FixIntersect Deployments still using the CreditsReported by Vishal Shukla (@shukla304). Affected versions
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
+ 278 more Show less
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.14
6.8.15
6.8.16
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.6
7.0.7
7.0.8
7.0.9
7.1.0
7.1.1
7.1.10
7.1.11
7.1.12
7.1.13
7.1.14
7.1.15
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.1.9
Fixed in
6.8.12
7.0.35
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-54177
GHSA-8q2w-pv9p-mjvc
Aug 20, 2026
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
Summary
DetailsThe The newer Applications that follow the Backpack quickstart without adding explicit ImpactAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the Conditions required for exploitation:
FixA denylist for server-executable extensions has been added to both Recommended developer actionReview all upload fields and add explicit Reported by Vishal Shukla (@shukla304) via sechub.dev. Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54176
GHSA-9fw9-8c49-qch8
Aug 20, 2026
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
6.5
/ 10
Medium
Network
Low
High
None
Unchanged
High
High
None
Summary
The password-change endpoint in the same controller correctly requires DetailsThe Scenarios where this is exploitable include:
PatchFixed in #5990 — the
authentication column is now protected by a A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's Affected versionsAll versions prior to 6.8.14 / 7.0.38. Fixed versions
Affected versions
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
+ 146 more Show less
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.11
6.8.12
6.8.13
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.14
7.0.38
References Updated Aug 20, 2026 · Source: OSV.dev
CVE-2026-54175
GHSA-xpv2-hrfc-hw62
Aug 20, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
7.6
/ 10
High
Network
Low
Low
None
Unchanged
Low
High
Low
SummaryThe For the default Laravel 11 Vulnerable code
Impact
Fix recommendationReplace This preserves Coordinates
— therawdev (responsible disclosure) Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304) Affected versions
0.4.1
0.5.0
0.5.1
0.5.10
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7
+ 662 more Show less
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.18
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.28
3.1.29
3.1.3
3.1.30
3.1.31
3.1.32
3.1.33
3.1.34
3.1.35
3.1.36
3.1.37
3.1.38
3.1.39
3.1.4
3.1.40
3.1.41
3.1.42
3.1.43
3.1.44
3.1.45
3.1.46
3.1.47
3.1.48
3.1.49
3.1.5
3.1.50
3.1.51
3.1.52
3.1.53
3.1.54
3.1.55
3.1.56
3.1.57
3.1.58
3.1.59
3.1.6
3.1.60
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.2.10
3.2.11
3.2.12
3.2.13
3.2.14
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.2
3.2.20
3.2.21
3.2.22
3.2.23
3.2.24
3.2.25
3.2.26
3.2.27
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.9
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.13
3.3.14
3.3.15
3.3.16
3.3.17
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.1
3.4.10
3.4.11
3.4.12
3.4.13
3.4.14
3.4.15
3.4.16
3.4.17
3.4.18
3.4.19
3.4.2
3.4.20
3.4.21
3.4.22
3.4.23
3.4.24
3.4.25
3.4.26
3.4.27
3.4.28
3.4.29
3.4.3
3.4.30
3.4.31
3.4.32
3.4.33
3.4.34
3.4.35
3.4.36
3.4.37
3.4.38
3.4.39
3.4.4
3.4.40
3.4.41
3.4.42
3.4.43
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.1
3.5.10
3.5.11
3.5.12
3.5.13
3.5.14
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.1
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.2
3.6.20
3.6.21
3.6.22
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.6.29
3.6.3
3.6.30
3.6.31
3.6.32
3.6.33
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.29
4.0.3
4.0.30
4.0.31
4.0.32
4.0.33
4.0.34
4.0.35
4.0.36
4.0.37
4.0.38
4.0.40
4.0.41
4.0.42
4.0.43
4.0.44
4.0.45
4.0.47
4.0.48
4.0.49
4.0.5
4.0.50
4.0.51
4.0.52
4.0.53
4.0.54
4.0.55
4.0.56
4.0.57
4.0.58
4.0.59
4.0.6
4.0.60
4.0.61
4.0.62
4.0.63
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.11
4.1.12
4.1.13
4.1.14
4.1.15
4.1.16
4.1.17
4.1.18
4.1.19
4.1.2
4.1.20
4.1.21
4.1.22
4.1.23
4.1.24
4.1.25
4.1.26
4.1.27
4.1.28
4.1.29
4.1.3
4.1.30
4.1.31
4.1.32
4.1.33
4.1.34
4.1.35
4.1.36
4.1.37
4.1.38
4.1.39
4.1.4
4.1.40
4.1.41
4.1.42
4.1.43
4.1.44
4.1.45
4.1.46
4.1.47
4.1.48
4.1.49
4.1.5
4.1.50
4.1.51
4.1.52
4.1.53
4.1.54
4.1.55
4.1.56
4.1.57
4.1.58
4.1.59
4.1.6
4.1.60
4.1.61
4.1.62
4.1.63
4.1.64
4.1.65
4.1.66
4.1.67
4.1.68
4.1.69
4.1.7
4.1.70
4.1.71
4.1.72
4.1.8
4.1.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.15
5.4.16
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.10
6.1.11
6.1.12
6.1.13
6.1.14
6.1.15
6.1.16
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.5.5
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.7.0
6.7.1
6.7.10
6.7.11
6.7.12
6.7.13
6.7.14
6.7.15
6.7.16
6.7.17
6.7.18
6.7.19
6.7.2
6.7.20
6.7.21
6.7.22
6.7.23
6.7.24
6.7.25
6.7.26
6.7.27
6.7.28
6.7.29
6.7.3
6.7.30
6.7.31
6.7.32
6.7.33
6.7.34
6.7.35
6.7.36
6.7.37
6.7.38
6.7.39
6.7.4
6.7.40
6.7.41
6.7.42
6.7.43
6.7.44
6.7.45
6.7.46
6.7.47
6.7.48
6.7.49
6.7.5
6.7.50
6.7.51
6.7.52
6.7.53
6.7.54
6.7.55
6.7.56
6.7.6
6.7.7
6.7.8
6.7.9
6.8.0
6.8.1
6.8.10
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
6.8.7
6.8.8
6.8.9
v4.0.46
7.0.0
7.0.0-alpha.1
7.0.0-alpha.2
7.0.0-alpha.3
7.0.0-alpha.4
7.0.0-alpha.5
7.0.0-alpha.6
7.0.0-alpha.7
7.0.0-alpha.8
7.0.0-alpha.9
7.0.0-beta.1
7.0.0-beta.10
7.0.0-beta.11
7.0.0-beta.12
7.0.0-beta.13
7.0.0-beta.14
7.0.0-beta.15
7.0.0-beta.16
7.0.0-beta.17
7.0.0-beta.18
7.0.0-beta.2
7.0.0-beta.3
7.0.0-beta.4
7.0.0-beta.5
7.0.0-beta.6
7.0.0-beta.7
7.0.0-beta.8
7.0.0-beta.9
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
Fixed in
6.8.11
7.0.34
References
Updated Aug 20, 2026 · Source: OSV.dev |