CVE-2026-54179: Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles() — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the stored file to receive an extensionless filename, because mime_content_type() returns false when given a data URI instead of a filesystem path.

The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension.