CVE-2026-54182

Backpack for Laravel's backpack/crud package builds a shell command in Backpack\CRUD\Stats::makeCurlRequest (src/Stats.php), reached during service-provider boot, using a URL derived from the attacker-influenced HTTP Host header and passes it to exec() without adequate shell neutralization. An unauthenticated attacker who sends requests with a malformed Host header that reaches PHP can inject operating-system commands whenever exec() and curl are available and a 1-in-100 random gate is hit, which can be reached reliably simply by repeating requests. Successful exploitation runs commands as the web-server user, exposing environment secrets, files, and reachable services, and allowing data modification or service disruption. All deployments on versions prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36 are affected, though common reverse-proxy Host validation and hardened PHP configurations (exec() disabled) reduce practical reachability without fixing the flaw. No public proof of concept or in-the-wild exploitation is known at this time.

What to do: Upgrade backpack/crud immediately to 4.1.70, 5.6.2, 6.8.13, or 7.0.36 depending on your major-version branch. As interim hardening, add exec to PHP's disable_functions (or block the outbound curl path), and enforce strict Host header validation/rewriting at your reverse proxy or load balancer so malformed Host values never reach PHP. Review web-server and outbound-connection logs for unusual Host headers or unexpected curl activity as an indicator of attempted exploitation.