Vulnerability-Lookup

CVE-2026-54178 (GCVE-0-2026-54178)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:49 – Updated: 2026-09-16 16:03

Title

backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

Summary

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_<attribute>[] and passes them to Storage::disk()->delete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator through src/app/Models/Traits/CrudTrait.php can delete another record's attachment, a shared asset, or another operational file on the configured disk by submitting its path. The newer MultipleFiles uploader is not affected because it intersects requested deletions with the record's persisted file list. This flaw does not permit reading the deleted files. The 5.x line remains affected through its final releases. This issue is fixed in versions 6.8.12 and 7.0.35.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 16:01 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-285 - Improper Authorization
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root Scorecard

References

7 references

URL	Tags
https://github.com/Laravel-Backpack/CRUD/security…	x_refsource_CONFIRM
https://github.com/Laravel-Backpack/CRUD/pull/5982	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/pull/5983	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/0…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/b…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Laravel-Backpack	CRUD	Affected: >= 5.0.0, < 6.0.0 Affected: >= 6.0.0, < 6.8.12 Affected: >= 7.0.0, < 7.0.35

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54178",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T16:01:40.246547Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T16:03:33.705Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 6.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.8.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.35"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_\u003cattribute\u003e[] and passes them to Storage::disk()-\u003edelete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator through src/app/Models/Traits/CrudTrait.php can delete another record\u0027s attachment, a shared asset, or another operational file on the configured disk by submitting its path. The newer MultipleFiles uploader is not affected because it intersects requested deletions with the record\u0027s persisted file list. This flaw does not permit reading the deleted files. The 5.x line remains affected through its final releases. This issue is fixed in versions 6.8.12 and 7.0.35."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:49:40.641Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8xjm-wqrp-2f25",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8xjm-wqrp-2f25"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/5982",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/5982"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/5983",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/5983"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/0c7e095a869b8d1bd5668b1370a83b148e75bf4e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/0c7e095a869b8d1bd5668b1370a83b148e75bf4e"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/baae0420b6ebefaf5fe4cd88c1fc358feb9c2816",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/baae0420b6ebefaf5fe4cd88c1fc358feb9c2816"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.12"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.35",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.35"
        }
      ],
      "source": {
        "advisory": "GHSA-8xjm-wqrp-2f25",
        "discovery": "UNKNOWN"
      },
      "title": "backpack/crud: Arbitrary file deletion via attacker-controlled clear_\u003cattr\u003e[] in HasUploadFields::uploadMultipleFilesToDisk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54178",
    "datePublished": "2026-09-14T17:49:40.641Z",
    "dateReserved": "2026-06-11T21:46:52.382Z",
    "dateUpdated": "2026-09-16T16:03:33.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54178",
      "date": "2026-10-02",
      "epss": "0.00562",
      "percentile": "0.44747"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "CRUD",
                "vendor": "Laravel-Backpack",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 5.0.0, \u003c 6.0.0"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 6.0.0, \u003c 6.8.12"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 7.0.0, \u003c 7.0.35"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_\u003cattribute\u003e[] and passes them to Storage::disk()-\u003edelete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator through src/app/Models/Traits/CrudTrait.php can delete another record\u0027s attachment, a shared asset, or another operational file on the configured disk by submitting its path. The newer MultipleFiles uploader is not affected because it intersects requested deletions with the record\u0027s persisted file list. This flaw does not permit reading the deleted files. The 5.x line remains affected through its final releases. This issue is fixed in versions 6.8.12 and 7.0.35."
          }
        ],
        "id": "CVE-2026-54178",
        "lastModified": "2026-09-30T17:51:56.193",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54178",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T16:01:40.246547Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-14T18:17:52.917",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/commit/0c7e095a869b8d1bd5668b1370a83b148e75bf4e"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/commit/baae0420b6ebefaf5fe4cd88c1fc358feb9c2816"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/pull/5982"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/pull/5983"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.12"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.35"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8xjm-wqrp-2f25"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              },
              {
                "lang": "en",
                "value": "CWE-285"
              },
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54178",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-16T16:01:40.246547Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-16T16:03:29.887Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "CRUD",
              "vendor": "Laravel-Backpack",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 5.0.0, \u003c 6.0.0"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 6.0.0, \u003c 6.8.12"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 7.0.0, \u003c 7.0.35"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_\u003cattribute\u003e[] and passes them to Storage::disk()-\u003edelete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator through src/app/Models/Traits/CrudTrait.php can delete another record\u0027s attachment, a shared asset, or another operational file on the configured disk by submitting its path. The newer MultipleFiles uploader is not affected because it intersects requested deletions with the record\u0027s persisted file list. This flaw does not permit reading the deleted files. The 5.x line remains affected through its final releases. This issue is fixed in versions 6.8.12 and 7.0.35."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "CWE-285: Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-14T17:49:40.641Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8xjm-wqrp-2f25",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8xjm-wqrp-2f25"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/pull/5982",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/pull/5982"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/pull/5983",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/pull/5983"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/commit/0c7e095a869b8d1bd5668b1370a83b148e75bf4e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/commit/0c7e095a869b8d1bd5668b1370a83b148e75bf4e"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/commit/baae0420b6ebefaf5fe4cd88c1fc358feb9c2816",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/commit/baae0420b6ebefaf5fe4cd88c1fc358feb9c2816"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.12",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.12"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.35",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.35"
            }
          ],
          "source": {
            "advisory": "GHSA-8xjm-wqrp-2f25",
            "discovery": "UNKNOWN"
          },
          "title": "backpack/crud: Arbitrary file deletion via attacker-controlled clear_\u003cattr\u003e[] in HasUploadFields::uploadMultipleFilesToDisk"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54178",
        "datePublished": "2026-09-14T17:49:40.641Z",
        "dateReserved": "2026-06-11T21:46:52.382Z",
        "dateUpdated": "2026-09-16T16:03:33.705Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-369682

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:37

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:37:24.674883+00:00",
  "id": "EUVD-2026-369682"
}

FKIE_CVE-2026-54178

Vulnerability from fkie_nvd - Published: 2026-09-14 18:17 - Updated: 2026-09-30 17:51

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/commit/0c7e095a869b8d1bd5668b1370a83b148e75bf4e
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/commit/baae0420b6ebefaf5fe4cd88c1fc358feb9c2816
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/pull/5982
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/pull/5983
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.12
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.35
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8xjm-wqrp-2f25

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 6.0.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.8.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.35"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_\u003cattribute\u003e[] and passes them to Storage::disk()-\u003edelete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator through src/app/Models/Traits/CrudTrait.php can delete another record\u0027s attachment, a shared asset, or another operational file on the configured disk by submitting its path. The newer MultipleFiles uploader is not affected because it intersects requested deletions with the record\u0027s persisted file list. This flaw does not permit reading the deleted files. The 5.x line remains affected through its final releases. This issue is fixed in versions 6.8.12 and 7.0.35."
    }
  ],
  "id": "CVE-2026-54178",
  "lastModified": "2026-09-30T17:51:56.193",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54178",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T16:01:40.246547Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T18:17:52.917",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/0c7e095a869b8d1bd5668b1370a83b148e75bf4e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/baae0420b6ebefaf5fe4cd88c1fc358feb9c2816"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5982"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5983"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.12"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.35"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8xjm-wqrp-2f25"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8XJM-WQRP-2F25

Vulnerability from github – Published: 2026-08-20 18:38 – Updated: 2026-08-20 18:38

Summary

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

Details

Summary

HasUploadFields::uploadMultipleFilesToDisk (in src/app/Models/Traits/HasUploadFields.php) reads file paths from the clear_<attribute>[] request input and deletes them from the configured storage disk without verifying that the paths belong to the current model record.

An authenticated user with Update access on any CRUD that wires uploadMultipleFilesToDisk as a model mutator (the pattern documented in the v5.x upload_multiple field guide) can supply arbitrary disk-relative paths in clear_<attr>[] to delete files that were never associated with the record they are editing.

The safe pattern already exists in the codebase: src/app/Library/Uploaders/MultipleFiles.php intersects the requested deletions against the files currently stored in the database column before calling Storage::disk()->delete(). The trait method lacks that intersection.

Affected code

src/app/Models/Traits/HasUploadFields.php — uploadMultipleFilesToDisk (primary sink)
src/app/Models/Traits/CrudTrait.php — mixes HasUploadFields into all Backpack-managed models

The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases.

Impact

An attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted).

CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H = 8.1 High

Fix

Intersect $files_to_clear against the filenames currently persisted on the model before calling delete(), mirroring the logic already present in MultipleFiles::uploadFiles. Fixed in 6.8.12 and 7.0.35.

Deployments still using the uploadMultipleFilesToDisk mutator pattern from the v5.x docs should migrate to the Uploader API (MultipleFiles::class via config/backpack/crud.php), which applies the safe intersection automatically.

Credits

Reported by Vishal Shukla (@shukla304).

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 6.0.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.8.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.35"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54178"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-285",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:38:39Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`HasUploadFields::uploadMultipleFilesToDisk` (in `src/app/Models/Traits/HasUploadFields.php`) reads file paths from the `clear_\u003cattribute\u003e[]` request input and deletes them from the configured storage disk **without verifying that the paths belong to the current model record**.\n\nAn authenticated user with Update access on any CRUD that wires `uploadMultipleFilesToDisk` as a model mutator (the pattern documented in the v5.x `upload_multiple` field guide) can supply arbitrary disk-relative paths in `clear_\u003cattr\u003e[]` to delete files that were never associated with the record they are editing.\n\nThe safe pattern already exists in the codebase: `src/app/Library/Uploaders/MultipleFiles.php` intersects the requested deletions against the files currently stored in the database column before calling `Storage::disk()-\u003edelete()`. The trait method lacks that intersection.\n\n## Affected code\n\n- `src/app/Models/Traits/HasUploadFields.php` \u2014 `uploadMultipleFilesToDisk` (primary sink)\n- `src/app/Models/Traits/CrudTrait.php` \u2014 mixes `HasUploadFields` into all Backpack-managed models\n\nThe vulnerability is present in all 5.x, 6.x \u003c 6.8.12, and 7.x \u003c 7.0.35 releases.\n\n## Impact\n\nAn attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records\u0027 attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted).\n\n**CWE-285** (Authorization Bypass) / **CWE-639** (IDOR on file deletion)  \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H = **8.1 High**\n\n## Fix\n\nIntersect `$files_to_clear` against the filenames currently persisted on the model before calling `delete()`, mirroring the logic already present in `MultipleFiles::uploadFiles`. Fixed in **6.8.12** and **7.0.35**.\n\nDeployments still using the `uploadMultipleFilesToDisk` mutator pattern from the v5.x docs should migrate to the Uploader API (`MultipleFiles::class` via `config/backpack/crud.php`), which applies the safe intersection automatically.\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)).",
  "id": "GHSA-8xjm-wqrp-2f25",
  "modified": "2026-08-20T18:38:39Z",
  "published": "2026-08-20T18:38:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-8xjm-wqrp-2f25"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.35"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_\u003cattr\u003e[] in HasUploadFields::uploadMultipleFilesToDisk"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54178 (GCVE-0-2026-54178)

EUVD-2026-369682

FKIE_CVE-2026-54178

GHSA-8XJM-WQRP-2F25

Summary

Affected code

Impact

Fix

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour