{"id":"CVE-2026-54179","summary":"backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk","details":"backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.","aliases":["GHSA-8hw4-7qjr-3wxg"],"modified":"2026-09-02T03:47:26.078608662Z","published":"2026-08-31T20:09:50.087Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-434","CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54179.json"},"references":[{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"},{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54179.json"},{"type":"ADVISORY","url":"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8hw4-7qjr-3wxg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54179"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/commit/18b3dc1c607775617f563c41bd1ddb983f11d751"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/pull/5989"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/laravel-backpack/crud","events":[{"introduced":"56c091f2099b6e17a37034e76a1da65f9052e842"},{"introduced":"9abc482607aaaefcd6ee2455bc0a6e603cc1b69f"},{"fixed":"76c3a6e50e3fbd6d5f633208da5b04acb8322969"},{"fixed":"5c5de0af242619d0653c7c70c900cd15b1a197c5"},{"fixed":"18b3dc1c607775617f563c41bd1ddb983f11d751"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"6.0.0"},{"fixed":"6.8.14"},{"introduced":"7.0.0"},{"fixed":"7.0.38"}]}}],"versions":["6.8.13","7.0.37","7.0.36","6.8.12","7.0.35","7.0.34","6.8.11","7.0.33","7.0.32","7.0.31","7.0.30","6.8.10","7.0.29","7.0.28","7.0.27","7.0.26","7.0.25","7.0.24","7.0.23","7.0.22","7.0.21","6.8.9","7.0.20","7.0.19","7.0.18","7.0.17","7.0.16","7.0.15","7.0.14","7.0.13","7.0.12","7.0.11","7.0.10","7.0.9","7.0.8","7.0.7","7.0.6","7.0.5","7.0.4","7.0.3","7.0.2","7.0.1","7.0.0","6.8.8","6.8.7","6.8.6","6.8.5","6.8.4","6.8.3","6.8.2","6.8.1","7.0.0-alpha.2","6.8.0","6.7.56","6.7.55","6.7.54","6.7.53","6.7.52","6.7.51","6.7.50","6.7.49","6.7.48","6.7.47","6.7.46","6.7.45","6.7.44","6.7.43","6.7.42","6.7.41","6.7.40","6.7.39","6.7.38","6.7.37","6.7.36","6.7.35","6.7.34","6.7.33","6.7.32","6.7.31","6.7.30","6.7.29","6.7.28","6.7.26","6.7.27","6.7.25","6.7.24","6.7.23","6.7.22","6.7.21","6.7.20","6.7.19","6.7.18","6.7.17","6.7.16","6.7.15","6.7.14","6.7.13","6.7.12","6.7.11","6.7.10","6.7.9","6.7.8","6.7.7","6.7.6","6.7.5","6.7.4","6.7.3","6.7.2","6.7.1","6.7.0","6.6.6","6.6.5","6.6.4","6.6.3","6.6.2","6.6.1","6.6.0","6.5.5","6.5.4","6.5.3","6.5.2","6.5.1","6.5.0","6.4.2","6.4.1","6.4.0","6.3.2","6.3.1","6.3.0","6.2.4","6.2.3","6.2.1","6.2.2","6.2.0","6.1.16","6.1.15","6.1.14","6.1.13","6.1.12","6.1.11","6.1.10","6.1.9","6.1.8","6.1.7","6.1.6","6.1.5","6.1.4","6.1.3","6.1.2","6.1.1","6.1.0","6.0.7","6.0.6","6.0.5","6.0.4","6.0.3","6.0.2","6.0.0","6.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54179.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}