{"id":"CVE-2026-54177","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-54177","summary":"Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver","details":"## Summary\n\n`HasUploadFields` (used via `CrudTrait` on Backpack-managed models) and the `withFiles()` uploader preserve the client-supplied file extension without validation. On installations using a `public` disk with `php artisan storage:link`, this allows an authenticated administrator to upload a file with a server-executable extension that the web server will pass to the PHP interpreter - if no MIME or other type of upload validation is present.\n\n## Details\n\nThe `uploadFileToDisk` and `uploadMultipleFilesToDisk` methods hash the filename stem but write the client-supplied extension to disk verbatim — no allowlist, blocklist, or MIME check is applied inside the trait itself.\n\nThe newer `withFiles()` path (via `FileNameGenerator`) resolves the extension from the file's MIME type rather than the client filename, but also does not block server-executable types.\n\nApplications that follow the Backpack quickstart without adding explicit `mimes:` or `mimetypes:` validation rules in their form requests are affected.\n\n## Impact\n\nAn authenticated administrator with access to an upload-enabled CRUD panel, on a site using the `public` disk with web-accessible storage and no MIME type validation, can upload a server-executable file and achieve remote code execution.\n\n**Conditions required for exploitation:**\n\n- Authenticated admin access to a Backpack CRUD panel\n- An upload field with no `mimes:` / `mimetypes:` validation rule\n- The `public` disk in use (standard pattern for web-visible uploads)\n- `php artisan storage:link` in place\n- A web server + PHP-FPM stack (default on most hosts)\n\n## Fix\n\nA denylist for server-executable extensions has been added to both `HasUploadFields` and `FileNameGenerator`. Image-typed fields now additionally enforce an allowlist. This is defence-in-depth — it does not replace application-level validation.\n\n## Recommended developer action\n\nReview all upload fields and add explicit `mimes:` or `mimetypes:` validation in your form requests or field definitions. Refer to the [Backpack field documentation](https://backpackforlaravel.com/docs) for examples.\n\n---\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)) via sechub.dev.","published":"2026-08-20T18:38:34Z","modified":"2026-08-20T18:45:17.506282655Z","cvss":{"score":6.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"backpack/crud","fixedVersion":"6.8.14"},{"ecosystem":"Packagist","name":"backpack/crud","fixedVersion":"7.0.38"}],"fix":{"url":"https://github.com/Laravel-Backpack/CRUD/pull/5993","label":"Laravel-Backpack/CRUD#5993"},"references":[{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8q2w-pv9p-mjvc"},{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/pull/5993"},{"type":"PACKAGE","url":"https://github.com/Laravel-Backpack/CRUD"},{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"},{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-20T18:45:17.506282655Z"}}