PHP package security

Is backpack/crud vulnerable?

Q: Does backpack/crud have known vulnerabilities?

Yes. Packagist lists 11 security advisories for backpack/crud (4 high, 7 medium severity). The most recent, reported 2026-08-20, is "Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation". The newest release, 7.1.24, is outside every affected range.

Q: Which version of backpack/crud should I run?

The newest stable release is 7.1.24 (published 2026-11-01). The most recent advisory is fixed in 6.8.15 and 7.0.47, so stay on or above the fixed version for your major version. Run composer update backpack/crud, then composer audit to confirm nothing else is flagged.

Q: How do I check if my backpack/crud version is affected?

Run composer show backpack/crud in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.

11 known security advisories for backpack/crud. The latest was reported on 2026-08-20 and is fixed in 6.8.15 and 7.0.47. The newest release, 7.1.24, is not affected by any of them.

4 high 7 medium

Known advisories: 11
Newest release: 7.1.24
Released: 2026-11-01
Affecting newest release: 0
Last synced: 2026-11-03

Quickly build admin interfaces using Laravel, Bootstrap and JavaScript. · packagist.org/packages/backpack/crud

Check your version

Run composer show backpack/crud in your project to see the installed version, then enter it here.

Security advisories for backpack/crud

Newest first. “Affected” is the Composer version constraint from the advisory; “fixed in” is each version the advisory names as the first safe one on its release line.

Reported	Advisory	Severity	Affected	Fixed in
2026-08-20	Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation GHSA-42vx-43vc-x6pr · CVE-2026-57570 · GitHub	medium	>=6.0.0,<6.8.15 \| >=7.0.0,<7.0.47	6.8.15, 7.0.47
2026-08-20	Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) GHSA-mrc5-3mm3-45c5 · CVE-2026-54182 · GitHub	high	>=7.0.0,<7.0.36 \| >=6.0.0,<6.8.13 \| >=5.0.0,<5.6.2 \| >=4.1.0,<4.1.72	4.1.72, 5.6.2, 6.8.13, 7.0.36
2026-08-20	Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted GHSA-mmg4-322v-6jvc · CVE-2026-54181 · GitHub	medium	>=7.0.0,<7.0.38 \| >=6.0.0,<6.8.14	6.8.14, 7.0.38
2026-08-20	Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) GHSA-vgmv-8xjc-6rch · CVE-2026-54180 · GitHub	high	>=7.0.0,<7.0.38 \| >=6.0.0,<6.8.14	6.8.14, 7.0.38
2026-08-20	Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk GHSA-8hw4-7qjr-3wxg · CVE-2026-54179 · GitHub	medium	>=7.0.0,<7.0.38 \| >=6.0.0,<6.8.14	6.8.14, 7.0.38
2026-08-20	Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk GHSA-8xjm-wqrp-2f25 · CVE-2026-54178 · GitHub	high	>=7.0.0,<7.0.35 \| >=6.0.0,<6.8.12 \| >=5.0.0,<6.0.0	6.0.0, 6.8.12, 7.0.35
2026-08-20	Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver GHSA-8q2w-pv9p-mjvc · CVE-2026-54177 · GitHub	medium	>=7.0.0,<7.0.38 \| >=6.0.0,<6.8.14	6.8.14, 7.0.38
2026-08-20	Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check GHSA-9fw9-8c49-qch8 · CVE-2026-54176 · GitHub	medium	>=7.0.0,<7.0.38 \| >=6.0.0,<6.8.14	6.8.14, 7.0.38
2026-08-20	Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment GHSA-xpv2-hrfc-hw62 · CVE-2026-54175 · GitHub	high	>=7.0.0-alpha.1,<7.0.34 \| <6.8.11	6.8.11, 7.0.34
2026-06-03	backpack/crud is vulnerable to Cross-Site Scripting (XSS) GHSA-m8xx-3x29-84h8 · CVE-2022-31114 · GitHub	medium	<4.0.63 \| >=4.1.0,<4.1.69 \| >=5.0.0,<5.0.13	4.0.63, 4.1.69, 5.0.13
2022-05-24	Backpack\CRUD for Laravel XSS Vulnerability GHSA-6gfm-gpr3-8wh9 · CVE-2018-20962 · GitHub	medium	<3.4.9	3.4.9

Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.

Ask about a fix

Check your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.

Check composer.lock

Questions about backpack/crud

Does backpack/crud have known vulnerabilities?

Yes. Packagist lists 11 security advisories for backpack/crud (4 high, 7 medium severity). The most recent, reported 2026-08-20, is "Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation". The newest release, 7.1.24, is outside every affected range.

Which version of backpack/crud should I run?

The newest stable release is 7.1.24 (published 2026-11-01). The most recent advisory is fixed in 6.8.15 and 7.0.47, so stay on or above the fixed version for your major version. Run composer update backpack/crud, then composer audit to confirm nothing else is flagged.

How do I check if my backpack/crud version is affected?

Run composer show backpack/crud in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.

Where this data comes from

Advisories come from the Packagist security advisories API, which collects the GitHub Advisory Database and the FriendsOfPHP security advisories. composer audit reads the same data. Releases come from packagist.org. Last synced 2026-11-03; we re-check daily. Each advisory links to its source. Spot an error? Tell us.

← All PHP packages