backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.
CVE-2026-54182
This high-severity CVE scores 8.1 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.4%, top 62% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- High severity, but no confirmed exploitation yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 8.1
- EG Score
- 8.1(medium)
- EG Risk
- 37(Track)EG Risk 37/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity81% × 45%Exploitation0% × 40%Automatability0% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 0%
- EPSS %ILE
- 38%
- KEV
- Not listed
Published
August 20, 2026
Last Modified
September 14, 2026
Advisory Details (10)
Auto-updated Sep 14, 20267.0.36
Patch available: Laravel-Backpack/CRUD 7.0.36
https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.366.8.13
Patch available: Laravel-Backpack/CRUD 6.8.13
https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.135.6.2
Patch available: Laravel-Backpack/CRUD 5.6.2
https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.24.1.72 🌈
Patch available: Laravel-Backpack/CRUD 4.1.72
https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72commit 471935e296b1 (Laravel-Backpack/CRUD)
Patch available: Laravel-Backpack/CRUD 4.1.72 (contains commit 471935e296b1)
https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601commit 282ba2a0b887 (Laravel-Backpack/CRUD)
Patch available: Laravel-Backpack/CRUD 7.0.41 (contains commit 282ba2a0b887)
https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0commit 1476a3769d94 (Laravel-Backpack/CRUD)
Patch available: Laravel-Backpack/CRUD 6.8.15 (contains commit 1476a3769d94)
https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2acommit 0f2faafc22a1 (Laravel-Backpack/CRUD)
Fix landed in Laravel-Backpack/CRUD commit 0f2faafc22a1 — awaiting tagged release
https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28cFixes
Patch available: Laravel-Backpack/CRUD 4.1.72 (PR #6012 merged 2026-06-03)
https://github.com/Laravel-Backpack/CRUD/pull/6012OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) · Advisory · Laravel-Backpack/CRUD · GitHub
https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5Vendor Advisories for CVE-2026-54182(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Affected Packages
(1 across 1 ecosystem)
Packagist(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| backpack/crud | 7.0.0 ... 7.0.9 (36 versions) | 7.0.36 | — |
Weakness Classification(3)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 10× in last 7d / 11× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-09-18 19:50 UTCEG score recompute
- 2026-09-18 19:28 UTCEPSS rescore
- 2026-09-17 21:19 UTCEG score recompute
- 2026-09-17 19:31 UTCEPSS rescore
- 2026-09-16 19:44 UTCEG score recompute
- 2026-09-16 14:08 UTCEPSS rescore
- 2026-09-16 06:05 UTCEG score recompute
- 2026-09-16 05:15 UTCEPSS rescore
- 2026-09-14 19:23 UTCEG score recompute
- 2026-09-14 18:28 UTCEG score recompute
- 2026-08-20 18:42 UTCEG score recompute
Frequently asked(5)
What is CVE-2026-54182?
When was CVE-2026-54182 disclosed?
Is CVE-2026-54182 actively exploited?
What is the CVSS score of CVE-2026-54182?
How do I remediate CVE-2026-54182?
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-54182
Is Your Infrastructure Affected by CVE-2026-54182?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.