[HIGH] Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

PKSA-qrrt-7bj6-f81q CVE-2026-54182 GHSA-mrc5-3mm3-45c5

Affected version: >=7.0.0,<7.0.36|>=6.0.0,<6.8.13|>=5.0.0,<5.6.2|>=4.1.0,<4.1.72

Reported by:
GitHub

[HIGH] Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

PKSA-kbc2-vykn-d61h CVE-2026-54178 GHSA-8xjm-wqrp-2f25

Affected version: >=7.0.0,<7.0.35|>=6.0.0,<6.8.12|>=5.0.0,<6.0.0

Reported by:
GitHub

[HIGH] Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

PKSA-x88v-wcq5-j3kt CVE-2026-54175 GHSA-xpv2-hrfc-hw62

Affected version: >=7.0.0-alpha.1,<7.0.34|<6.8.11

Reported by:
GitHub

[MEDIUM] backpack/crud is vulnerable to Cross-Site Scripting (XSS)

PKSA-8yrj-8khf-srxh CVE-2022-31114 GHSA-m8xx-3x29-84h8

Affected version: <4.0.63|>=4.1.0,<4.1.69|>=5.0.0,<5.0.13

Reported by:
GitHub