Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-54179 medium CVSS 4.4

Cross-Site Scripting (XSS) in backpack/crud (CVE-2026-54179)

Summary

Cross-site scripting in backpack/crud (CVE-2026-54179). Risk of unauthorized operations or information disclosure. Exploitable via image. Mitigation: upgrade to 7.0.38 or later.

Original description

The description as published by the source.

Summary

SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles() — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the stored file to receive an extensionless filename, because mime_content_type() returns false when given a data URI instead of a filesystem path.

The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension.

Details

// src/app/Library/Uploaders/SingleBase64Image.php
if (Str::startsWith($value, 'data:image')) {
    // MIME subtype and decoded bytes are not validated
    $base64Image = Str::after($value, ';base64,');
    $finalPath   = $this->getPath() . $this->getFileName($value);
    Storage::disk($this->getDisk())->put($finalPath, base64_decode($base64Image));
    return $finalPath;
}

// src/app/Library/Uploaders/Support/FileNameGenerator.php
private function getExtensionFromFile(string|UploadedFile $file): string
{
    return is_a($file, UploadedFile::class, true)
        ? $file->extension()
        : Str::after(mime_content_type($file), '/'); // returns false on data URIs → empty string
}

The stored filename ends with a trailing dot and no extension.

Impact

An authenticated admin submitting a malicious payload to a Backpack image field stored with…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-54179 has been found in backpack/crud.
Attackers can target a specific entry point like image over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 4.4/10.
What to do: upgrade backpack/crud to 7.0.38 or later.
If unsure, ask your IT team or search "backpack/crud CVE-2026-54179" on the vendor's site.

CVE-2026-54179 (backpack/crud) — CWE-79 / CVSS v3 4.4
Attack vector: remote (network-reachable)
Attack surface: image / FileNameGenerator / false / finfo
Patched: 7.0.38 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Cross-site scripting (XSS) (CWE-79) exists in backpack/crud. Attackers reach the vulnerable code path via image.

📍 Affected scope

Check the vendor advisory for the affected versions of backpack/crud. Attack surface: image / FileNameGenerator / false / finfo.

🔥 Severity

Severity: Medium (CVSS 4.4/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 7.0.38.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'backpack/crud' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'backpack/crud' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で backpack/crud を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade backpack/crud to 7.0.38

    ステージング環境で 7.0.38 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

composer backpack/crud
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.38"}]}]
Packagist backpack/crud
[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.38"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details