Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.
Published: 2026-08-31
Score: 4.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability originates in Backpack/CRUD’s SingleBase64Image uploader, which accepts any data URI that begins with data:image. It does not verify the declared MIME subtype or the actual decoded content, and the extension is derived from mime_content_type applied to the URI, allowing a user to store non-image data with an extensionless filename. When such a file is served, it can execute scripts contained in the payload, leading to stored cross‑site scripting and other unintended behaviors. The weakness corresponds to CWE‑434 (Unrestricted Upload of File with Dangerous Type) and CWE‑79 (Cross‑Site Scripting).

Affected Systems

Vendors affected are Laravel-Backpack:CRUD. Affected releases are all versions from 6.0.0 up to and including 6.8.14 and 7.0.37. The bug is fixed in 6.8.14 and 7.0.38.

Risk and Exploitability

The CVSS score is 4.4, indicating a moderate impact level. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a web-based authenticated administrator performing image uploads via the CRUD interface; the administrator must have write permission to the configured storage disk. Given the lack of public exploit data, the immediate risk is moderate, but the presence of stored XSS could be leveraged in targeted attacks.

Generated by OpenCVE AI on August 31, 2026 at 21:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Backpack/CRUD to version 7.0.38 or 6.8.14, which patch the upload validation logic.
  • If an upgrade is not immediately possible, enforce strict validation on the server side: reject any data URI with a data:image prefix unless the MIME type and decoded content match a whitelist of safe image types.
  • Configure the storage disk to be non‑executable and serve uploaded files through a protected controller or by disabling public access to the upload directory, ensuring that even if a malicious file is stored it cannot be executed directly by browsers.

Generated by OpenCVE AI on August 31, 2026 at 21:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-8hw4-7qjr-3wxg Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
History

Mon, 31 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Laravel-backpack
Laravel-backpack crud
Vendors & Products Laravel-backpack
Laravel-backpack crud

Mon, 31 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.
Title backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk
Weaknesses CWE-434
CWE-79
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Laravel-backpack Crud
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-31T20:09:50.087Z

Reserved: 2026-06-11T21:46:52.382Z

Link: CVE-2026-54179

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T21:17:09.670

Modified: 2026-08-31T21:17:09.670

Link: CVE-2026-54179

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T22:15:04Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')