Detections
Analytics

SCA: security update for backpack/crud (GHSA-8xjm-wqrp-2f25)

high Tenable Cloud Security Plugin ID 446148

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of
 Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35,
 HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-
 relative paths from clear_<attribute>[] and passes them to Storage::disk()->delete without confirming that
 the paths are persisted on the current model record. An authenticated user with Update access to a CRUD
 using this mutator through src/app/Models/Traits/CrudTrait.php can delete another record's attachment, a
 shared asset, or another operational file on the configured disk by submitting its path. The newer
 MultipleFiles uploader is not affected because it intersects requested deletions with the record's
 persisted file list. This flaw does not permit reading the deleted files. The 5.x line remains affected
 through its final releases. This issue is fixed in versions 6.8.12 and 7.0.35. (CVE-2026-54178)

Solution

Update the backpack/crud library and its related packages to version 6.8.12 or later.

See Also

https://github.com/advisories/GHSA-8xjm-wqrp-2f25

Plugin Details

Severity: High

ID: 446148

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 8/20/2026

Updated: 9/15/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C

CVSS Score Source: CVE-2026-54178

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/20/2026

Vulnerability Publication Date: 8/20/2026

Reference Information

CVE: CVE-2026-54178