[MEDIUM] Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

PKSA-4pjj-nc36-rj91 CVE-2026-54177 GHSA-8q2w-pv9p-mjvc

Affected package: backpack/crud

Affected version: >=7.0.0,<7.0.38|>=6.0.0,<6.8.14

Reported by:
GitHub