CVE-2026-54181
backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branches controlled by $column['escaped'], which defaults to true, causing $column['text'] to be rendered unescaped by default. An attacker who can store an unsanitized value in a color column can execute script in the browser of a user who views the CRUD list, including an administrator, with access to the victim's session-backed application capabilities. Exploitation requires write access to the stored color value and a victim viewing the list. This issue is fixed in versions 6.8.14 and 7.0.38.
| CWE | CWE-79 CWE-1023 |
| Vendor | laravel-backpack |
| Product | crud |
| Published | Sep 14, 2026 |
| Last Updated | Sep 14, 2026 |
Get instant alerts for laravel-backpack crud
Be the first to know when new medium vulnerabilities affecting laravel-backpack crud are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N