Laravel-Backpack vulnerabilities
We track 5 vulnerabilities in Laravel-Backpack products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2026.
Latest Laravel-Backpack vulnerabilities
- 8.1 High severity
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a…
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Sta
- 7.6 High severity
CRUD: Authorization Bypass Through User-Controlled Key
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve reco
- 8.1 High severity
CRUD: Improper Limitation of a Pathname to a Restricted Directory
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Tr
- 7.6 High severity
CRUD: Unverified Password Change
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Contro
- 9.8 Critical severity
FileManager: Deserialization of Untrusted Data
FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.