CVE-2026-54182 backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
Unauthenticated attackers can execute arbitrary OS commands via the Host header in Backpack CRUD, leading to code execution and data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54182?
CVE-2026-54182 is a high-severity command injection vulnerability in Laravel-Backpack CRUD, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.
Which versions are affected by CVE-2026-54182?
8 open source packages ship an affected version, including backpack/crud.
| Package | Affected | Fixed in |
|---|---|---|
backpack/crud Packagist | From 4.1.0 | 4.1.72 |
backpack/crud Packagist | From 4.1.0 | 4.1.72 |
backpack/crud Packagist | From 5.0.0 | 5.6.2 |
backpack/crud Packagist | From 5.0.0 | 5.6.2 |
backpack/crud Packagist | From 6.0.0 | 6.8.13 |
backpack/crud Packagist | From 6.0.0 | 6.8.13 |
2 more packages
backpack/crud Packagist | From 7.0.0 | 7.0.36 |
backpack/crud Packagist | From 7.0.0 | 7.0.36 |
How do I fix CVE-2026-54182?
Upgrade backpack/crud to a fixed version for your release line: 4.1.72, 5.6.2, 6.8.13 or 7.0.36.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-54182 being exploited?
There is no known exploitation of CVE-2026-54182 in the wild and no public exploit code.
Sources
Also known as GHSA-mrc5-3mm3-45c5.