CVE-2026-54179: Backpack CRUD Base64 Image Upload XSS Flaw

CVE-2026-54179 Overview

CVE-2026-54179 affects backpack/crud, a Laravel package that provides Create, Read, Update, and Delete (CRUD) functionality for building administration panels. The vulnerability exists in the SingleBase64Image uploader, which accepts any data URI beginning with data:image without validating the declared MIME subtype or the decoded bytes. An authenticated administrator can store arbitrary file content under an extensionless filename on the configured disk. When the resulting file is served, it can trigger stored cross-site scripting (XSS) [CWE-79] or other unintended behavior. The issue affects versions from 6.0.0 up to 6.8.14 and 7.0.37.

Critical Impact
Authenticated administrators can upload arbitrary content disguised as an image, resulting in stored XSS when the file is served to other users.

Affected Products

backpack/crud versions 6.0.0 through 6.8.13
backpack/crud versions 7.0.0 through 7.0.37
Laravel applications using Backpack image fields configured through withFiles()

Discovery Timeline

2026-08-31 - CVE-2026-54179 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-54179

Vulnerability Analysis

The flaw resides in src/app/Library/Uploaders/SingleBase64Image.php. The SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles methods accept any data URI whose prefix matches data:image. Neither method validates the declared MIME subtype nor inspects the decoded bytes to confirm the content is a real image.

A second defect exists in src/app/Library/Uploaders/Support/FileNameGenerator.php. The FileNameGenerator::getExtensionFromFile method calls mime_content_type() against the raw data URI string rather than the decoded content. Because mime_content_type() cannot interpret a data URI, the derived extension is empty, and the resulting file is written without a meaningful extension. Combined, these behaviors allow an authenticated administrator to persist attacker-controlled bytes (for example, HTML with <script> tags) on the configured disk.

Root Cause

The root cause is insufficient input validation on data URI payloads. The uploader trusts the client-declared prefix and never verifies that the decoded content is one of the intended image types (image/jpeg, image/png, image/gif, image/webp, image/avif).

Attack Vector

An authenticated administrator submits a crafted request to a form using an image field with withFiles() enabled. The payload uses a data:image/png;base64,... prefix but embeds arbitrary content, such as HTML or JavaScript. When another user retrieves the stored file from the configured disk, the browser interprets and executes the embedded script, resulting in stored XSS.

php

// Security patch in src/app/Library/Uploaders/SingleBase64Image.php
class SingleBase64Image extends Uploader
{
    private const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/avif'];

    private function validateAndDecodeBase64Image(string $value): string|false
    {
        if (! preg_match('#^data:image/(jpeg|png|gif|webp|avif);base64,#i', $value)) {
            return false;
        }

        $decoded = base64_decode(Str::after($value, ';base64,'), true);
        if ($decoded === false) {
            return false;
        }

        $detected = (new \finfo(FILEINFO_MIME_TYPE))->buffer($decoded);

        return in_array($detected, self::ALLOWED_MIME_TYPES, true) ? $decoded : false;
    }
}
// Source: https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751

The patch introduces an allow-list of MIME types, decodes the base64 payload strictly, and uses finfo to detect the actual MIME type from the decoded bytes before persisting the file.

Detection Methods for CVE-2026-54179

Indicators of Compromise

Files written to the configured Backpack disk with no file extension or a mismatch between filename and content.
Stored files whose byte content contains HTML, JavaScript, or SVG markup despite being uploaded through an image field.
Requests to CRUD endpoints containing large data:image/...;base64, payloads that decode to non-image content.

Detection Strategies

Audit uploaded files on the configured Backpack disk and compare declared extensions against the true MIME type reported by file or finfo.
Inspect application logs for administrator sessions that create or update records tied to image fields with unusually large or unusually shaped payloads.
Scan stored assets for HTML or script markers such as <script>, <svg onload=, or javascript: inside files served as images.

Monitoring Recommendations

Enable web server access logging for the URL prefix that serves Backpack uploaded files and alert on responses with a text or HTML content type.
Monitor administrator account activity in Laravel logs for repeated image submissions to CRUD forms shortly after account creation or password changes.
Track integrity of the uploads directory using file integrity monitoring on the storage disk configured for Backpack.

How to Mitigate CVE-2026-54179

Immediate Actions Required

Upgrade backpack/crud to version 7.0.38 or 6.8.14 via Composer without delay.
Review recently uploaded files in image-field storage directories and quarantine any that fail MIME validation against the decoded content.
Restrict administrator access to the Backpack admin panel and rotate credentials for any account suspected of abuse.

Patch Information

The fix is available in backpack/crud7.0.38 and 6.8.14. See the GitHub Security Advisory GHSA-8hw4-7qjr-3wxg, the GitHub Pull Request #5989, and the remediation commit. Release notes are published for 6.8.14 and 7.0.38.

Workarounds

Disable withFiles() on affected image fields until the upgrade is deployed.
Serve Backpack-managed uploads through a controller that forces a safe Content-Type header and adds Content-Disposition: attachment for non-image responses.
Add a web server rule that rejects responses from the uploads path whose sniffed MIME type is not on an image allow-list.

bash

# Update backpack/crud to a fixed release
composer require backpack/crud:^7.0.38
# or, for the 6.x branch
composer require backpack/crud:^6.8.14

# Verify the installed version
composer show backpack/crud | grep versions