Description

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-31T21:17:09.670Z",
  "pubdate": "2026-08-31T21:17:09.670Z",
  "executiveSummary": "An arbitrary file upload vulnerability exists in the backpack/crud package within the SingleBase64Image upload handler. This vulnerability allows an authenticated administrator to bypass file type validation by leveraging improper MIME type handling within the upload logic.\nThe vulnerability stems from the application's failure to validate the specific MIME subtype or the actual decoded binary content of provided data URIs. Instead, the system relies on an insecure check that validates only the prefix of the URI and incorrectly determines file extensions based on the URI string rather than the file's binary signature.\nAn authenticated attacker can upload arbitrary content, including malicious scripts, to the configured storage disk. This facilitates stored Cross-Site Scripting (XSS) or remote code execution, depending on the server's configuration and file execution policies. The attack requires administrative privileges to interact with the vulnerable CRUD interfaces. The flaw affects versions 6.0.0 through 6.8.13 and 7.0.0 through 7.0.37.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of base64-encoded image uploads within src/app/Library/Uploaders/SingleBase64Image.php. Specifically, the methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles perform an insufficient validation check, merely verifying that the input URI begins with the string 'data:image'. This check fails to validate the MIME subtype (e.g., image/jpeg vs. text/html) or the decoded byte content, permitting non-image payloads to be processed as valid files.\nFurther exacerbating the issue is the FileNameGenerator::getExtensionFromFile method located in src/app/Library/Uploaders/Support/FileNameGenerator.php. This method invokes mime_content_type() on the raw data URI string rather than on the binary stream resulting from the base64 decoding process. Consequently, the application logic assumes the file type based on the provided metadata within the URI, which is trivially manipulated by an attacker.\nThe attack flow proceeds as follows: An authenticated administrator with access to the CRUD interface crafts a malicious payload encapsulated in a data URI. By setting the data URI prefix to 'data:image/x-empty' or similar, the attacker satisfies the weak validation check. The application then writes the decoded binary content to the target storage disk. Because the filename generation logic is flawed, the resulting file may be saved without a proper extension or with an extension derived from the deceptive metadata provided in the malicious URI. When this file is later requested by a user or an automated process, the web server may serve the malicious content, leading to stored XSS if the file contains script tags, or potential code execution if the environment allows for the interpretation of files stored on the disk.\nThis vulnerability is present in backpack/crud versions 6.0.0 up to 6.8.14 (exclusive of fixed version) and 7.0.37 (exclusive of fixed version). Successful exploitation requires administrative privileges, as the vulnerable components are typically exposed within the protected administrator panel of the Laravel application."
}