CVE-2026-54181 Details
Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branches controlled by $column['escaped'], which defaults to true, causing $column['text'] to be rendered unescaped by default. An attacker who can store an unsanitized value in a color column can execute script in the browser of a user who views the CRUD list, including an administrator, with access to the victim's session-backed application capabilities. Exploitation requires write access to the stored color value and a victim viewing the list. This issue is fixed in versions 6.8.14 and 7.0.38.
A stored cross-site scripting vulnerability has been identified in Backpack CRUD versions 6.0.0 prior to 6.8.14 and 7.0.0 prior to 7.0.38. The issue arises in the Blade template for the color column type, where the rendering branches for escaped and raw content are inverted. This flaw allows an attacker to inject unsanitized values that are executed as scripts in the browsers of users viewing the CRUD list, including administrators. Exploitation requires write access to the color column and a victim to view the list.
Users can upgrade to Backpack CRUD versions 6.8.14 or 7.0.38, where this vulnerability has been fixed. Additionally, validating color values against a strict CSS color grammar at the model layer can help prevent exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Laravel-Backpack/CRUD/commit/608652b1020ba274781f222d2959d7780a559a08 | [email protected] | Source CodeVendor |
| https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969 | [email protected] | Source CodeVendor |
| https://github.com/Laravel-Backpack/CRUD/pull/5992 | [email protected] | Issue TrackingVendor |
| https://github.com/Laravel-Backpack/CRUD/pull/5994 | [email protected] | Issue TrackingVendor |
| https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14 | [email protected] | Release NotesVendor |
| https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38 | [email protected] | Release NotesVendor |
| https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mmg4-322v-6jvc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1023 | Incomplete Comparison with Missing Factors | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| backpack/crud | >= 6.0.0, < 6.8.14 (semver) >= 7.0.0, < 7.0.38 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |