CVE-2022-31114
backpack/crud Vulnerable to Cross-site Scripting
Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions prior to 5.0.13, 4.1.69, and 4.0.63 are vulnerable to cross-site scripting. An attacker could conduct a targeted phishing campaign, in order to trick users or admins into clicking a malicious link, which under very specific circumstances could give them information or possibly admin access. Versions 5.0.13, 4.1.69, and 4.0.63 patch the issue. As a workaround, manually look inside error views in `resources/views/errors` and output `e($exception->getMessage())` instead of `$exception->getMessage()`.
INFO
Published Date :
June 3, 2026, 4:16 p.m.
Last Modified :
July 21, 2026, 7:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update backpack/crud to version 5.0.13 or higher.
- Update backpack/crud to version 4.1.69 or higher.
- Update backpack/crud to version 4.0.63 or higher.
- Apply error view workaround: echo e($exception->getMessage()).
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2022-31114.
| URL | Resource |
|---|---|
| https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-m8xx-3x29-84h8 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2022-31114 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2022-31114
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2022-31114 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2022-31114 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 21, 2026
Action Type Old Value New Value Added Translation Title: CRUD de Laravel-Backpack, Description: backpack/crud proporciona funciones de Crear, Leer, Actualizar y Eliminar (CRUD) para Backpack, una colección de paquetes de Laravel que ayudan a los usuarios a construir paneles de administración personalizados. Las versiones anteriores a 5.0.13, 4.1.69 y 4.0.63 son vulnerables a cross-site scripting. Un atacante podría llevar a cabo una campaña de phishing dirigida, para engañar a usuarios o administradores para que hagan clic en un enlace malicioso, lo que bajo circunstancias muy específicas podría darles información o posiblemente acceso de administrador. Las versiones 5.0.13, 4.1.69 y 4.0.63 parchean el problema. Como solución alternativa, busque manualmente dentro de las vistas de error en 'resources/views/errors' y genere 'e($exception->getMessage())' en lugar de '$exception->getMessage()'. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Laravel-Backpack', 'product': 'CRUD', 'versions': [{'status': 'affected', 'version': '>= 5.0.0, < 5.0.13'}, {'status': 'affected', 'version': '>= 4.0.0, < 4.1.69'}, {'status': 'affected', 'version': '< 4.0.63'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2022-31114', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-03T16:01:14.919643Z'} -
New CVE Received by [email protected]
Jun. 03, 2026
Action Type Old Value New Value Added Description backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions prior to 5.0.13, 4.1.69, and 4.0.63 are vulnerable to cross-site scripting. An attacker could conduct a targeted phishing campaign, in order to trick users or admins into clicking a malicious link, which under very specific circumstances could give them information or possibly admin access. Versions 5.0.13, 4.1.69, and 4.0.63 patch the issue. As a workaround, manually look inside error views in `resources/views/errors` and output `e($exception->getMessage())` instead of `$exception->getMessage()`. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-79 Added Reference https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-m8xx-3x29-84h8