The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this->guard()->user()->update($request->except(['_token'])). Because the controller uses except(['_token']) rather than $request->validated() or the restricted keys defined in AccountInfoRequest::validationData(), any column present in the user model's $fillable array is mass-assigned from the request, including password. Backpack ships a separate POST /admin/change-password route (postChangePasswordForm) that requires old_password verification via ChangePasswordRequest::withValidator. The edit-account-info endpoint silently bypasses that security control. For the default Laravel 11 App\Models\User model — …
The Blade template for the color column type (src/resources/views/crud/columns/color.blade.php) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column['escaped'] defaults to true, values stored in color columns are rendered unescaped by default, enabling Stored XSS if column values are not validated before storage.
SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles() — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the stored file to receive an extensionless filename, because mime_content_type() returns false when given a data URI instead of a filesystem path. The combination allows an authenticated admin to store …
Backpack\CRUD\Stats::makeCurlRequest builds a shell command using unescaped input that originates from the HTTP Host header, then passes it to exec(). A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary OS commands as the web user. The vulnerable code path is reached from BackpackServiceProvider::boot() on every HTTP request in production when exec() and curl are available. A 1-in-100 random gate is …
MyAccountController::postAccountInfoForm allows an authenticated user to update the authentication column (default: email) without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's session ends: the new email address can be used to request a password reset from outside the system. The password-change endpoint in the same controller correctly requires old_password verification, so the gap is asymmetric.
HasUploadFields (used via CrudTrait on Backpack-managed models) and the withFiles() uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a server-executable extension that the web server will pass to the PHP interpreter - if no MIME or other type of upload validation is present.
Backpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations. When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model. This could allow an authenticated, low-privileged admin user to affect …
Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause() / addBaseClause() (e.g. tenant isolation, user ownership). However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query. An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write …
HasUploadFields::uploadMultipleFilesToDisk (in src/app/Models/Traits/HasUploadFields.php) reads file paths from the clear_<attribute>[] request input and deletes them from the configured storage disk without verifying that the paths belong to the current model record. An authenticated user with Update access on any CRUD that wires uploadMultipleFilesToDisk as a model mutator (the pattern documented in the v5.x upload_multiple field guide) can supply arbitrary disk-relative paths in clear_<attr>[] to delete files that were never associated with …
It’s a “moderate” vulnerability… but being an admin panel, take this seriously. It’s difficult… but an attacker could conduct a targeted phishing campaign, in order to trick your users or admins to click a malicious link, which under very specific circumstances could give them information… or even admin access. It’s unlikely, but that’s not good enough in admin panels - It should be made impossible. That’s why you are bothered …