CVE-2026-54179

Name of the Vulnerable Software and Affected Versions backpack/crud versions 6.0.0 through 6.8.13 backpack/crud versions 7.0.0 through 7.0.37

Description An authenticated administrator can store arbitrary file content on the configured disk. This occurs because the SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles functions, used by image fields through withFiles(), accept any data URI starting with data:image without validating the declared MIME subtype or the decoded bytes. Additionally, the FileNameGenerator::getExtensionFromFile function applies mime content type() to the data URI instead of the decoded content, resulting in files being stored with extensionless filenames. This can lead to stored cross-site scripting (XSS) or other unintended behavior when the file is served and accessed.

Recommendations Update backpack/crud to version 6.8.14. Update backpack/crud to version 7.0.38. As a defense-in-depth measure, set X-Content-Type-Options: nosniff on admin responses.