CVE-2026-54177: Laravel Backpack CRUD HasUploadFields Keeps The Attacker-supplied File Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8q2w-pv9p-mjvc",
  "modified" : "2026-08-20T18:38:34Z",
  "published" : "2026-08-20T18:38:34Z",
  "aliases" : [ "CVE-2026-54177" ],
  "summary" : "Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver",
  "details" : "## Summary\n\n`HasUploadFields` (used via `CrudTrait` on Backpack-managed models) and the `withFiles()` uploader preserve the client-supplied file extension without validation. On installations using a `public` disk with `php artisan storage:link`, this allows an authenticated administrator to upload a file with a server-executable extension that the web server will pass to the PHP interpreter - if no MIME or other type of upload validation is present.\n\n## Details\n\nThe `uploadFileToDisk` and `uploadMultipleFilesToDisk` methods hash the filename stem but write the client-supplied extension to disk verbatim — no allowlist, blocklist, or MIME check is applied inside the trait itself.\n\nThe newer `withFiles()` path (via `FileNameGenerator`) resolves the extension from the file's MIME type rather than the client filename, but also does not block server-executable types.\n\nApplications that follow the Backpack quickstart without adding explicit `mimes:` or `mimetypes:` validation rules in their form requests are affected.\n\n## Impact\n\nAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the `public` disk with web-accessible storage and no MIME type validation, can upload a server-executable file and achieve remote code execution.\n\n**Conditions required for exploitation:**\n\n- Authenticated admin access to a Backpack CRUD panel\n- An upload field with no `mimes:` / `mimetypes:` validation rule\n- The `public` disk in use (standard pattern for web-visible uploads)\n- `php artisan storage:link` in place\n- A web server + PHP-FPM stack (default on most hosts)\n\n## Fix\n\nA denylist for server-executable extensions has been added to both `HasUploadFields` and `FileNameGenerator`. Image-typed fields now additionally enforce an allowlist. This is defence-in-depth — it does not replace application-level validation.\n\n## Recommended developer action\n\nReview all upload fields and add explicit `mimes:` or `mimetypes:` validation in your form requests or field definitions. Refer to the [Backpack field documentation](https://backpackforlaravel.com/docs) for examples.\n\n---\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)) via sechub.dev.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "backpack/crud"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.0.0"
      }, {
        "fixed" : "6.8.14"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "backpack/crud"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0"
      }, {
        "fixed" : "7.0.38"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8q2w-pv9p-mjvc"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Laravel-Backpack/CRUD/pull/5993"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Laravel-Backpack/CRUD"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-434" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-20T18:38:34Z",
    "nvd_published_at" : null
  }
}