[MEDIUM] Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

PKSA-1hj4-7f8v-mbzt CVE-2026-57570 GHSA-42vx-43vc-x6pr

Affected version: >=6.0.0,<6.8.15|>=7.0.0,<7.0.47

Reported by:
GitHub

[HIGH] Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

PKSA-qrrt-7bj6-f81q CVE-2026-54182 GHSA-mrc5-3mm3-45c5

Affected version: >=7.0.0,<7.0.36|>=6.0.0,<6.8.13|>=5.0.0,<5.6.2|>=4.1.0,<4.1.72

Reported by:
GitHub

[MEDIUM] Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

PKSA-5phc-pmxf-y81y CVE-2026-54181 GHSA-mmg4-322v-6jvc

Affected version: >=7.0.0,<7.0.38|>=6.0.0,<6.8.14

Reported by:
GitHub

[HIGH] Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

PKSA-s7xs-gg49-zwxc CVE-2026-54180 GHSA-vgmv-8xjc-6rch

Affected version: >=7.0.0,<7.0.38|>=6.0.0,<6.8.14

Reported by:
GitHub

[MEDIUM] Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

PKSA-gr8y-xsj7-jw48 CVE-2026-54179 GHSA-8hw4-7qjr-3wxg

Affected version: >=7.0.0,<7.0.38|>=6.0.0,<6.8.14

Reported by:
GitHub

[MEDIUM] Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

PKSA-4pjj-nc36-rj91 CVE-2026-54177 GHSA-8q2w-pv9p-mjvc

Affected version: >=7.0.0,<7.0.38|>=6.0.0,<6.8.14

Reported by:
GitHub

[MEDIUM] Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

PKSA-wb9h-r8p2-f7xj CVE-2026-54176 GHSA-9fw9-8c49-qch8

Affected version: >=7.0.0,<7.0.38|>=6.0.0,<6.8.14

Reported by:
GitHub