Vulnerability-Lookup

CVE-2026-54182 (GCVE-0-2026-54182)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:48 – Updated: 2026-09-14 18:17

Title

backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Summary

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 18:17 UTC

CWE

CWE-20 - Improper Input Validation
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-116 - Improper Encoding or Escaping of Output

Assigner

GitHub_M mitre root

References

10 references

URL	Tags
https://github.com/Laravel-Backpack/CRUD/security…	x_refsource_CONFIRM
https://github.com/Laravel-Backpack/CRUD/pull/6012	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/0…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/1…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/2…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/4…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Laravel-Backpack	CRUD	Affected: < 4.1.70 Affected: >= 5.0.0, < 5.6.2 Affected: >= 6.0.0, < 6.8.13 Affected: >= 7.0.0, < 7.0.36	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54182",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T18:17:38.848658Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T18:17:49.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.1.70"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.6.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.8.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.36"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\\CRUD\\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:48:21.509Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/6012",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/6012"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36"
        }
      ],
      "source": {
        "advisory": "GHSA-mrc5-3mm3-45c5",
        "discovery": "UNKNOWN"
      },
      "title": "backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54182",
    "datePublished": "2026-09-14T17:48:21.509Z",
    "dateReserved": "2026-06-11T21:46:52.382Z",
    "dateUpdated": "2026-09-14T18:17:49.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54182\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-14T18:17:53.380\",\"lastModified\":\"2026-09-14T19:17:30.167\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\\\\CRUD\\\\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Laravel-Backpack\",\"product\":\"CRUD\",\"versions\":[{\"version\":\"\u003c 4.1.70\",\"status\":\"affected\"},{\"version\":\"\u003e= 5.0.0, \u003c 5.6.2\",\"status\":\"affected\"},{\"version\":\"\u003e= 6.0.0, \u003c 6.8.13\",\"status\":\"affected\"},{\"version\":\"\u003e= 7.0.0, \u003c 7.0.36\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-14T18:17:38.848658Z\",\"id\":\"CVE-2026-54182\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-78\"},{\"lang\":\"en\",\"value\":\"CWE-116\"}]}],\"references\":[{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/pull/6012\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-20\", \"lang\": \"en\", \"description\": \"CWE-20: Improper Input Validation\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-78\", \"lang\": \"en\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-116\", \"lang\": \"en\", \"description\": \"CWE-116: Improper Encoding or Escaping of Output\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5\"}, {\"name\": \"https://github.com/Laravel-Backpack/CRUD/pull/6012\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/Laravel-Backpack/CRUD/pull/6012\"}, {\"name\": \"https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c\"}, {\"name\": \"https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a\"}, {\"name\": \"https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0\"}, {\"name\": \"https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601\"}, {\"name\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72\"}, {\"name\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2\"}, {\"name\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13\"}, {\"name\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36\"}], \"affected\": [{\"vendor\": \"Laravel-Backpack\", \"product\": \"CRUD\", \"versions\": [{\"version\": \"\u003c 4.1.70\", \"status\": \"affected\"}, {\"version\": \"\u003e= 5.0.0, \u003c 5.6.2\", \"status\": \"affected\"}, {\"version\": \"\u003e= 6.0.0, \u003c 6.8.13\", \"status\": \"affected\"}, {\"version\": \"\u003e= 7.0.0, \u003c 7.0.36\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-14T17:48:21.509Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\\\\CRUD\\\\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.\"}], \"source\": {\"advisory\": \"GHSA-mrc5-3mm3-45c5\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54182\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-14T18:17:38.848658Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-14T18:17:44.087Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54182\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-06-11T21:46:52.382Z\", \"datePublished\": \"2026-09-14T17:48:21.509Z\", \"dateUpdated\": \"2026-09-14T18:17:49.976Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-MRC5-3MM3-45C5

Vulnerability from github – Published: 2026-08-20 18:38 – Updated: 2026-08-20 18:38

Summary

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Details

Summary

Backpack\CRUD\Stats::makeCurlRequest builds a shell command using unescaped input that originates from the HTTP Host header, then passes it to exec(). A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary OS commands as the web user.

The vulnerable code path is reached from BackpackServiceProvider::boot() on every HTTP request in production when exec() and curl are available. A 1-in-100 random gate is the only guard — an attacker can reliably trigger it by retrying.

Severity

High — CVSS 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and exec() is often disabled for web processes in hardened environments. Both mitigations must be absent for exploitation.

Impact

A successful exploit yields OS command execution as the web server user (www-data, nginx, etc.), giving an unauthenticated attacker access to environment secrets (APP_KEY, database credentials, API keys in .env), the filesystem, and any service the server can reach.

Fix

makeCurlRequest was replaced with the Guzzle-based path already present in the codebase, eliminating the shell-command construction entirely. Upgrade to a patched release immediately.

Affected versions

Branch	Vulnerable range	First safe version
4.1.x	`< 4.1.70`	4.1.70
5.x	`< 5.6.2`	5.6.2
6.x	`< 6.8.13`	6.8.13
7.x	`< 7.0.36`	7.0.36

Credits

Reported by Vishal Shukla (@shukla304) via sechub.dev AI Agent.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.72"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.8.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.36"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54182"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-20",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:38:55Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`Backpack\\CRUD\\Stats::makeCurlRequest` builds a shell command using unescaped input that originates from the HTTP `Host` header, then passes it to `exec()`. A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary OS commands as the web user.\n\nThe vulnerable code path is reached from `BackpackServiceProvider::boot()` on every HTTP request in production when `exec()` and `curl` are available. A 1-in-100 random gate is the only guard \u2014 an attacker can reliably trigger it by retrying.\n\n## Severity\n\n**High \u2014 CVSS 8.1**  \n`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`\n\nAttack Complexity is rated **High** because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and `exec()` is often disabled for web processes in hardened environments. Both mitigations must be absent for exploitation.\n\n## Impact\n\nA successful exploit yields OS command execution as the web server user (`www-data`, `nginx`, etc.), giving an unauthenticated attacker access to environment secrets (APP_KEY, database credentials, API keys in `.env`), the filesystem, and any service the server can reach.\n\n## Fix\n\n`makeCurlRequest` was replaced with the Guzzle-based path already present in the codebase, eliminating the shell-command construction entirely. **Upgrade to a patched release immediately.**\n\n## Affected versions\n\n| Branch | Vulnerable range | First safe version |\n|--------|-----------------|-------------------|\n| 4.1.x  | `\u003c 4.1.70`      | 4.1.70            |\n| 5.x    | `\u003c 5.6.2`       | 5.6.2             |\n| 6.x    | `\u003c 6.8.13`      | 6.8.13            |\n| 7.x    | `\u003c 7.0.36`      | 7.0.36            |\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)) via sechub.dev AI Agent.",
  "id": "GHSA-mrc5-3mm3-45c5",
  "modified": "2026-08-20T18:38:55Z",
  "published": "2026-08-20T18:38:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54182 (GCVE-0-2026-54182)

GHSA-MRC5-3MM3-45C5

Summary

Severity

Impact

Fix

Affected versions

Credits

Tags

Sightings

Nomenclature