Backpack\CRUD for Laravel XSS Vulnerability

MEDIUM 6.1CVE-2018-20962 · GHSA-6gfm-gpr3-8wh9 · Published 08/08/2019 · updated 17/06/2026

In short

CVE-2018-20962 is a MEDIUM (CVSS 6.1) vulnerability affecting backpack/crud, backpack\crud (backpackforlaravel).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.8% of all vulnerabilities.
Fix: update to 3.4.9 or later.

Package	Affected versions	Patched versions
backpack/crud Packagist	`< 3.4.9`	`3.4.9`
backpack\crud backpackforlaravel	`< 3.4.9`	`3.4.9`

The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.

NVD description

The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

< 3.4.9

3.4.9

< 3.4.9

3.4.9

More vulnerabilities in backpack/crud

See all →