Description

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-14T18:17:53.380Z",
  "pubdate": "2026-09-14T18:17:53.380Z",
  "executiveSummary": "This vulnerability is an Operating System (OS) Command Injection flaw found in the Backpack/CRUD package for Laravel. The issue originates from the improper sanitization of user-supplied input within the Backpack\\CRUD\\Stats::makeCurlRequest method.\nBy manipulating the HTTP Host header, an unauthenticated attacker can inject arbitrary shell commands that are subsequently executed by the server via the PHP exec() function. Because this function is invoked automatically during the application boot process, the vulnerability poses a critical risk to the confidentiality, integrity, and availability of the underlying server infrastructure.\nSuccessful exploitation allows an attacker to execute commands with the privileges of the web-server user. This level of access grants the capability to exfiltrate sensitive environment variables, compromise configuration files, access internal network services, or disrupt service availability. While the vulnerability is gated by a 1-in-100 random execution frequency, the ability to perform repeated requests makes successful exploitation statistically inevitable. Systems running versions prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36 are susceptible to this attack.",
  "technicalDetails": "The vulnerability resides in the Backpack\\CRUD\\Stats::makeCurlRequest method located in src/Stats.php. This method is automatically triggered during the Laravel application lifecycle via the BackpackServiceProvider::boot() routine. The function is designed to perform telemetry or statistical reporting by constructing and executing a shell command that leverages the system's curl utility.\nThe root cause of the vulnerability is the unsafe construction of this shell command string. The implementation incorporates the HTTP Host header directly into the command string without any form of shell neutralization or input validation. Because the Host header is controlled by the client, an attacker can supply a malicious payload containing shell metacharacters, such as backticks, semicolons, or command substitution sequences, to break out of the intended command structure.\nThe attack flow proceeds as follows: First, an attacker crafts an HTTP request containing a malformed Host header that includes OS command injection payloads. Second, this request is sent to the target server. Third, when the BackpackServiceProvider::boot() method is invoked, it calls Stats::makeCurlRequest. Fourth, the server processes the user-influenced Host header and concatenates it into a shell string passed to exec(). Fifth, provided the 1-in-100 random gate condition is met, the system executes the attacker-supplied command within the server's shell environment.\nThe exploitation is feasible for any unauthenticated attacker capable of reaching the web application. While hardened PHP configurations that disable the exec() function effectively mitigate the risk, the vulnerability remains inherently dangerous in default environments. The impact of successful exploitation is significant; as the code executes under the context of the web-server user (e.g., www-data), the attacker can access sensitive application files, including .env files containing database credentials and API keys, interact with local network resources, or install persistence mechanisms on the server.\nAffected versions include all instances of backpack/crud prior to the patched releases: 4.1.70, 5.6.2, 6.8.13, and 7.0.36. There are no privilege requirements, as the vulnerability is reachable by any unauthenticated remote user, provided the application's hosting environment supports the execution of external shell commands via PHP."
}