CVE-2026-54182

backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Published Sep 14, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.

Analysis

Technical impact

Backpack‑CRUD, a Laravel package suite for admin panels, has a flaw in Stats::makeCurlRequest. The method concatenates an attacker‑controlled HTTP Host header into a shell command that is passed to exec() without proper sanitization. When exec() and curl are available, an unauthenticated attacker can trigger a 1‑in‑100 “random gate” by sending repeated requests. If the gate opens, arbitrary OS commands run as the web‑server user, exposing environment secrets, files, and enabling data modification or service disruption.

Affected Systems

All releases of Laravel‑Backpack:CRUD before 4.1.70, 5.6.2, 6.8.13, and 7.0.36 are affected. These are the versions that have not yet applied the vendor‑supplied patch.

Risk and Exploitability

The CVSS score of 8.1 classifies the issue as High severity. The EPSS score of less than 1% indicates a low probability of exploitation, but the vulnerability is not in CISA’s KEV catalog. A remote attacker can exploit the flaw over the network with no authentication by sending crafted Host headers. Repeated requests allow the attacker to hit the random gate, executing arbitrary OS commands as the web‑server user, which can lead to credential theft, data tampering, or denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Laravel-Backpack

CRUD

affected

Version	Status	Constraints
`< 4.1.70`	affected	—
`>= 5.0.0, < 5.6.2`	affected	—
`>= 6.0.0, < 6.8.13`	affected	—
`>= 7.0.0, < 7.0.36`	affected	—

No data.

Vendor Product Versions

Laravel-backpack

Crud

Version	Status	Scheme	Platform
`[0,4.1.70)`	affected	semver	—
`[5.0.0,5.6.2)`	affected	semver	—
`[6.0.0,6.8.13)`	affected	semver	—
`[7.0.0,7.0.36)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Backpack‑CRUD to a patched release (4.1.70, 5.6.2, 6.8.13, or 7.0.36).
Disable or restrict PHP’s exec() function via php.ini disable_functions if exec() is not required for other features.
Validate or sanitize the HTTP Host header so that only legitimate values reach Stats::makeCurlRequest, or configure the web server to strip the header for internal requests.

Generated by OpenCVE AI on September 20, 2026 at 22:53 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-mrc5-3mm3-45c5	Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.781% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c
https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a
https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0
https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601
https://github.com/Laravel-Backpack/CRUD/pull/6012
https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72
https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2
https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13
https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36
https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5

History

Sep 15, 2026 5:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Laravel-backpack Laravel-backpack crud
Vendors & Products		Laravel-backpack Laravel-backpack crud

Sep 14, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.
Title		backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
Weaknesses		CWE-116 CWE-20 CWE-78
References		https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0 https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601 https://github.com/Laravel-Backpack/CRUD/pull/6012 https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72 https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2 https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13 https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36 https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Subscriptions

Laravel-backpack Crud

Weaknesses

CWE-116
Improper Encoding or Escaping of Output
CWE-20
Improper Input Validation
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')