Detections
Analytics

SCA: security update for backpack/crud (GHSA-8q2w-pv9p-mjvc)

medium Tenable Self-Hosted Container Security Plugin ID 446174

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of
 Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38,
 HasUploadFields methods uploadFileToDisk and uploadMultipleFilesToDisk, used through CrudTrait, and the
 withFiles() path through FileNameGenerator do not internally reject server-executable file types. An
 authenticated administrator can achieve remote code execution by using an upload-enabled CRUD field
 without mimes: and mimetypes: validation when the public disk is web-accessible through php artisan
 storage:link and the web-server and PHP-FPM configuration executes the stored extension. The legacy path
 preserves an accepted extension and the newer path derives an extension without blocking dangerous types.
 The package-level restriction is defense in depth and does not replace application-level upload
 validation. This issue is fixed in versions 6.8.14 and 7.0.38. (CVE-2026-54177)

Solution

Update the backpack/crud library and its related packages to version 6.8.14 or later.

See Also

https://github.com/advisories/GHSA-8q2w-pv9p-mjvc

Plugin Details

Severity: Medium

ID: 446174

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 8/20/2026

Updated: 9/15/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:H/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2026-54177

CVSS v3

Risk Factor: Medium

Base Score: 6.6

Temporal Score: 5.8

Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/20/2026

Vulnerability Publication Date: 8/20/2026

Reference Information

CVE: CVE-2026-54177

cwe: CWE-434