CVE-2026-54182

Status: DeferredHigh (8.1)—

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization.

Read full descriptionShow less

An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base score: 8.1

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.78%
Percentile among all scored CVEs: 54
Score date: 10/4/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access85 %
Primary impactT1059 Command and Scripting Interpreterexecution90 %
Secondary impactT1005 Data from Local Systemcollection75 %
Secondary impactT1565 Data Manipulationimpact70 %

Vulnerabilidad de inyección de comandos en parámetro Host HTTP procesado por exec() sin sanitización. AV:N permite explotación remota sin autenticación. Ejecuta comandos del servidor web, accede a secretos/archivos y permite modificación de datos.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management Network Segmentation Vulnerability Scanning Restrict Web-Based Content Restrict File and Directory Permissions Remote Data Storage

Affected technologies (2)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Laravel — Laravel^AI Yangyouwang — Crud^AI

CWEs

CWE-20, CWE-78, CWE-116

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-54182",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54182",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-14T18:17:38.848658Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Laravel-Backpack",
          "product": "CRUD",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.1.70"
            },
            {
              "status": "affected",
              "version": ">= 5.0.0, < 5.6.2"
            },
            {
              "status": "affected",
              "version": ">= 6.0.0, < 6.8.13"
            },
            {
              "status": "affected",
              "version": ">= 7.0.0, < 7.0.36"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-14T18:17:53.380",
  "references": [
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/6012",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\\CRUD\\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36."
    }
  ],
  "lastModified": "2026-09-30T19:57:08.043",
  "sourceIdentifier": "security-advisories@github.com"
}