{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/backpack-for-laravel/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Backpack for Laravel"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Backpack"],"content_html":"\u003cp\u003eLaravel Backpack contains a high-severity remote code execution vulnerability (CVE-2026-54182) within its \u003ccode\u003eStats::makeCurlRequest\u003c/code\u003e method. The vulnerability arises because the package constructs a shell command using unescaped input derived from the HTTP \u003ccode\u003eHost\u003c/code\u003e header and executes it via the PHP \u003ccode\u003eexec()\u003c/code\u003e function. This vulnerability is reachable pre-authentication during the \u003ccode\u003eBackpackServiceProvider::boot()\u003c/code\u003e process, which executes on every request in production.\u003c/p\u003e\n\u003cp\u003eWhile the application includes a 1-in-100 random execution gate, attackers can trigger the exploit reliably through automated retries. Successful exploitation requires a server environment where the PHP \u003ccode\u003eexec()\u003c/code\u003e function is enabled and the web server (e.g., Nginx or Apache) fails to normalize or reject malformed \u003ccode\u003eHost\u003c/code\u003e headers. If these conditions are met, an attacker can gain command execution under the privileges of the web user, leading to full compromise of the application environment, including access to secrets stored in \u003ccode\u003e.env\u003c/code\u003e files and internal network resources.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target application running a vulnerable version of Backpack for Laravel.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP request with a malicious \u003ccode\u003eHost\u003c/code\u003e header containing shell injection payloads (e.g., \u003ccode\u003e; command; #\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe request reaches the web server, which forwards the request to the PHP backend without stripping the malicious \u003ccode\u003eHost\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eBackpackServiceProvider::boot()\u003c/code\u003e is triggered during the standard request lifecycle.\u003c/li\u003e\n\u003cli\u003eThe application execution hits the 1-in-100 random gate; the attacker retries the request until the logic proceeds to \u003ccode\u003eStats::makeCurlRequest\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emakeCurlRequest\u003c/code\u003e method injects the header into a string passed to the PHP \u003ccode\u003eexec()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe operating system spawns a shell process to execute the injected payload with the privileges of the web server user.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves code execution to exfiltrate environment variables, modify local files, or move laterally within the network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full unauthenticated remote code execution. Attackers can exfiltrate sensitive configuration data, including \u003ccode\u003eAPP_KEY\u003c/code\u003e, database credentials, and third-party API keys. This provides a vector for full data exfiltration, service disruption, and potential lateral movement into internal infrastructure connected to the compromised web host. The number of affected deployments is widespread across applications utilizing the Backpack for Laravel framework.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Backpack for Laravel to the patched versions (4.1.70, 5.6.2, 6.8.13, 7.0.36) immediately to remove the \u003ccode\u003emakeCurlRequest\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eAudit web server configurations to ensure that \u003ccode\u003eHost\u003c/code\u003e headers are validated against an allowlist of expected domains and that invalid requests are dropped before reaching the application layer.\u003c/li\u003e\n\u003cli\u003eConfigure PHP to disable the \u003ccode\u003eexec()\u003c/code\u003e, \u003ccode\u003eshell_exec()\u003c/code\u003e, and \u003ccode\u003epassthru()\u003c/code\u003e functions in production environments if they are not strictly required for application functionality.\u003c/li\u003e\n\u003cli\u003eDeploy web server logging to monitor for anomalous characters (semicolons, backticks, pipe symbols) within the \u003ccode\u003eHost\u003c/code\u003e header field of incoming HTTP requests.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T19:13:33Z","date_published":"2026-08-20T19:13:33Z","id":"https://feed.craftedsignal.io/briefs/2026-08-laravel-backpack-rce/","summary":"An unauthenticated command injection vulnerability in Laravel Backpack's Stats::makeCurlRequest method allows remote code execution by exploiting unsanitized Host header input passed to an exec() shell command.","title":"Remote Code Execution in Laravel Backpack via Host Header Injection","url":"https://feed.craftedsignal.io/briefs/2026-08-laravel-backpack-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Backpack for Laravel","version":"https://jsonfeed.org/version/1.1"}