{"answers":{"affected":"8 open source packages ship an affected version, including backpack/crud.","exploited":"There is no known exploitation of CVE-2026-54182 in the wild and no public exploit code.","fix":"Upgrade backpack/crud to a fixed version for your release line: 4.1.72, 5.6.2, 6.8.13 or 7.0.36.","what":"CVE-2026-54182 is a high-severity command injection vulnerability in Laravel-Backpack CRUD, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-54182 and fix it if it is affected.\n\nWhat it is: CVE-2026-54182 is a high-severity command injection vulnerability in Laravel-Backpack CRUD, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-54182 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- backpack/crud (Packagist): affected from 4.1.0; fixed in 4.1.72\n- backpack/crud (Packagist): affected from 4.1.0; fixed in 4.1.72\n- backpack/crud (Packagist): affected from 5.0.0; fixed in 5.6.2\n- backpack/crud (Packagist): affected from 5.0.0; fixed in 5.6.2\n- backpack/crud (Packagist): affected from 6.0.0; fixed in 6.8.13\n- backpack/crud (Packagist): affected from 6.0.0; fixed in 6.8.13\n- backpack/crud (Packagist): affected from 7.0.0; fixed in 7.0.36\n- backpack/crud (Packagist): affected from 7.0.0; fixed in 7.0.36\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-54182/ (Markdown: https://insights.sbomify.com/CVE-2026-54182/index.md)","id":"CVE-2026-54182","markdown":"https://insights.sbomify.com/CVE-2026-54182/index.md","name":"CVE-2026-54182","record":{"aliases":["GHSA-mrc5-3mm3-45c5"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Laravel CRUD package","requires_auth":"none","summary":"Unauthenticated attackers can execute arbitrary OS commands via the Host header in Backpack CRUD, leading to code execution and data modification.","user_interaction":"not_required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-116","name":"Improper Encoding or Escaping of Output"}],"description":"backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\\CRUD\\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)","id":"CVE-2026-54182","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"command_injection","year":"2026"},"n_packages":8,"n_references":10,"next":{"headline":"Apache Airflow: Airflow Variables were not masked in the UI for authenticated users","id":"CVE-2026-54183"},"packages":[{"ecosystem":"Packagist","fixed":["4.1.72"],"introduced":["4.1.0"],"last_affected":[],"package":"backpack/crud","purl":null,"source":"GHSA-mrc5-3mm3-45c5"},{"ecosystem":"Packagist","fixed":["4.1.72"],"introduced":["4.1.0"],"last_affected":[],"package":"backpack/crud","purl":"pkg:composer/backpack/crud","source":"GHSA-mrc5-3mm3-45c5"},{"ecosystem":"Packagist","fixed":["5.6.2"],"introduced":["5.0.0"],"last_affected":[],"package":"backpack/crud","purl":null,"source":"GHSA-mrc5-3mm3-45c5"},{"ecosystem":"Packagist","fixed":["5.6.2"],"introduced":["5.0.0"],"last_affected":[],"package":"backpack/crud","purl":"pkg:composer/backpack/crud","source":"GHSA-mrc5-3mm3-45c5"},{"ecosystem":"Packagist","fixed":["6.8.13"],"introduced":["6.0.0"],"last_affected":[],"package":"backpack/crud","purl":null,"source":"GHSA-mrc5-3mm3-45c5"},{"ecosystem":"Packagist","fixed":["6.8.13"],"introduced":["6.0.0"],"last_affected":[],"package":"backpack/crud","purl":"pkg:composer/backpack/crud","source":"GHSA-mrc5-3mm3-45c5"},{"ecosystem":"Packagist","fixed":["7.0.36"],"introduced":["7.0.0"],"last_affected":[],"package":"backpack/crud","purl":null,"source":"GHSA-mrc5-3mm3-45c5"},{"ecosystem":"Packagist","fixed":["7.0.36"],"introduced":["7.0.0"],"last_affected":[],"package":"backpack/crud","purl":"pkg:composer/backpack/crud","source":"GHSA-mrc5-3mm3-45c5"}],"prev":{"headline":"backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted","id":"CVE-2026-54181"},"products":["CRUD"],"published":"2026-09-14","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-09-14","vendors":["Laravel-Backpack"]},"summary":"Unauthenticated attackers can execute arbitrary OS commands via the Host header in Backpack CRUD, leading to code execution and data modification.","url":"https://insights.sbomify.com/CVE-2026-54182/"}