[HIGH] Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

PKSA-qrrt-7bj6-f81q CVE-2026-54182 GHSA-mrc5-3mm3-45c5

Affected package: backpack/crud

Affected version: >=7.0.0,<7.0.36|>=6.0.0,<6.8.13|>=5.0.0,<5.6.2|>=4.1.0,<4.1.72

Reported by:
GitHub