backpack/crud (packagist) has 11 known vulnerabilities, the worst rated HIGH. Upgrade to 7.0.47 or later to clear all of them. No malicious-package signal is recorded.
The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this-guard()-user()-update($request-except(['token'])).
CyberXYZ does not call a package safe in absolute terms. It records 11 known vulnerabilities for backpack/crud (packagist), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does backpack/crud have known vulnerabilities?
Yes. CyberXYZ records 11 known vulnerabilities for backpack/crud (packagist), the worst rated HIGH. These include GHSA-xpv2-hrfc-hw62, GHSA-8xjm-wqrp-2f25, GHSA-vgmv-8xjc-6rch, GHSA-mrc5-3mm3-45c5, GHSA-9fw9-8c49-qch8.
Which version of backpack/crud should I use?
7.0.47 or later clears every advisory recorded for backpack/crud (packagist). Check the release you pick before installing it.
How do I check backpack/crud before installing?
Search backpack/crud in CyberXYZ Check at https://cyberxyz.io/check?q=backpack%2Fcrud. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 09:01 UTC. The most recent advisory here was published 2026-08-20. Updated continuously from NVD, GHSA, OSV and CNA feeds.