CVE-2026-541815.4MediumCWE-79

CVE-2026-54181: backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

Laravel-Backpack · CRUD

Affected: Laravel-Backpack CRUD · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.3%probability of exploitation in the next 30 days

24th percentile

050100

Higher than 24% of scored CVEs

5.4MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branches controlled by $column['escaped'], which defaults to true, causing $column['text'] to be rendered unescaped by default. An attacker who can store an unsanitized value in a color column can execute script in the browser of a user who views the CRUD list, including an administrator, with access to the victim's session-backed application capabilities. Exploitation requires write access to the stored color value and a victim viewing the list. This issue is fixed in versions 6.8.14 and 7.0.38.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Laravel-Backpack · CRUD>= 6.0.0, < 6.8.14; >= 7.0.0, < 7.0.38

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Cross-site Scripting
Vendor: Laravel-Backpack
Published: September 2026
Band: Unlikely (under 1%), September 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-54181 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.