# CVE-2026-54182: backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

> Unauthenticated attackers can execute arbitrary OS commands via the Host header in Backpack CRUD, leading to code execution and data modification.

- **Severity:** High 8.1 (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 14 Sep 2026
- **Updated:** 14 Sep 2026
- **Also known as:** GHSA-mrc5-3mm3-45c5

## What is CVE-2026-54182?

CVE-2026-54182 is a high-severity command injection vulnerability in Laravel-Backpack CRUD, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.

Weakness: CWE-78 (Improper Neutralization of Special Elements used in an OS Command), CWE-20 (Improper Input Validation), CWE-116 (Improper Encoding or Escaping of Output)

## Which versions are affected by CVE-2026-54182?

8 open source packages ship an affected version, including backpack/crud.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `backpack/crud` | Packagist | From 4.1.0 | 4.1.72 |
| `backpack/crud` | Packagist | From 4.1.0 | 4.1.72 |
| `backpack/crud` | Packagist | From 5.0.0 | 5.6.2 |
| `backpack/crud` | Packagist | From 5.0.0 | 5.6.2 |
| `backpack/crud` | Packagist | From 6.0.0 | 6.8.13 |
| `backpack/crud` | Packagist | From 6.0.0 | 6.8.13 |
| `backpack/crud` | Packagist | From 7.0.0 | 7.0.36 |
| `backpack/crud` | Packagist | From 7.0.0 | 7.0.36 |

## How do I fix CVE-2026-54182?

Upgrade backpack/crud to a fixed version for your release line: 4.1.72, 5.6.2, 6.8.13 or 7.0.36.

## Is CVE-2026-54182 being exploited?

There is no known exploitation of CVE-2026-54182 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-54182 and fix it if it is affected.

What it is: CVE-2026-54182 is a high-severity command injection vulnerability in Laravel-Backpack CRUD, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-54182 in the wild and no public exploit code.

Affected packages and fixed versions:
- backpack/crud (Packagist): affected from 4.1.0; fixed in 4.1.72
- backpack/crud (Packagist): affected from 4.1.0; fixed in 4.1.72
- backpack/crud (Packagist): affected from 5.0.0; fixed in 5.6.2
- backpack/crud (Packagist): affected from 5.0.0; fixed in 5.6.2
- backpack/crud (Packagist): affected from 6.0.0; fixed in 6.8.13
- backpack/crud (Packagist): affected from 6.0.0; fixed in 6.8.13
- backpack/crud (Packagist): affected from 7.0.0; fixed in 7.0.36
- backpack/crud (Packagist): affected from 7.0.0; fixed in 7.0.36

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-54182/ (Markdown: https://insights.sbomify.com/CVE-2026-54182/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-54182
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54182
- OSV: https://osv.dev/vulnerability/CVE-2026-54182

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-54182/
Summaries are generated and may contain mistakes; the official description above is the record.