CVE-2026-54178
Received Received - Intake

Path Traversal in Backpack CRUD

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_<attribute>[] and passes them to Storage::disk()->delete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator through src/app/Models/Traits/CrudTrait.php can delete another record's attachment, a shared asset, or another operational file on the configured disk by submitting its path. The newer MultipleFiles uploader is not affected because it intersects requested deletions with the record's persisted file list. This flaw does not permit reading the deleted files. The 5.x line remains affected through its final releases. This issue is fixed in versions 6.8.12 and 7.0.35.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54178
EUVD
EUVD-2026-77708

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
backpack crud to 7.0.35 (exc)
backpack crud 5.x
laravel-backpack crud 5.x
laravel-backpack crud to 6.8.12 (exc)
laravel-backpack crud to 7.0.35 (exc)
laravel-backpack crud 6.8.12
laravel-backpack crud 7.0.35

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in backpack/crud allows an authenticated user with update access to delete files not owned by their record by submitting arbitrary disk-relative paths in clear_<attribute>[] requests. The HasUploadFields::uploadMultipleFilesToDisk method fails to verify file ownership before deletion, enabling unauthorized file removal including attachments, shared assets, or operational files.

Detection Guidance

Check for unauthorized file deletions in application logs, particularly for requests containing clear_<attribute>[] parameters. Inspect Storage::disk()->delete() calls in HasUploadFields.php for improper path validation. Monitor for unexpected file deletions in shared or operational directories.

Impact Analysis

An attacker could delete critical files including other users' attachments, shared resources, or system files. This could disrupt operations, cause data loss, or lead to denial of service. The impact is limited to file deletion without exposing file contents.

Compliance Impact

This vulnerability could violate compliance requirements that mandate data integrity and availability. Unauthorized file deletion may result in non-compliance with GDPR's data integrity principle or HIPAA's integrity and availability requirements, potentially leading to regulatory penalties or data breach notifications.

Mitigation Strategies

Update Laravel-Backpack/CRUD to versions 6.8.12 or 7.0.35 immediately. Review and restrict user permissions to prevent unauthorized CRUD updates. Implement additional validation to ensure file paths belong to the current model before deletion. Consider migrating to the Uploader API for safer file handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54178. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart