backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.

Affected: Packagist: backpack/crud

### Summary

`SingleBase64Image::uploadFiles` — the uploader bound to `image`-typed fields via `withFiles()` — only verifies that the submitted value starts with the string `data:image`. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in `FileNameGenerator` causes the stored file to receive an extensionless filename, because `mime_content_type()` returns `false` when given a data URI instead of a filesystem path.

The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension.

### Details

```php // src/app/Library/Uploaders/SingleBase64Image.php if (Str::startsWith($value, 'data:image')) { // MIME subtype and decoded bytes are not validated $base64Image = Str::after($value, ';base64,'); $finalPath = $this->getPath() . $this->getFileName($value); Storage::disk($this->getDisk())->put($finalPath, base64_decode($base64Image)); return $finalPath; }

// src/app/Library/Uploaders/Support/FileNameGenerator.php private function getExtensionFromFile(string|UploadedFile $file): string { return is_a($file, UploadedFile::class, true) ? $file->extension() : Str::after(mime_content_type($file), '/'); // returns false on data URIs → empty string } ```

The stored filename ends with a trailing dot and no extension.

### Impact

An authenticated admin submitting a malicious payload to a Backpack `image` field stored wit…