CVE-2026-104478
Deferred Deferred - Pending Action

Formwork Path Traversal in BackupController

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: VulnCheck

Description
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-104478
EUVD
EUVD-2026-91854

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getformwork formwork to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Formwork before 2.3.13 has a path traversal vulnerability in BackupController that allows authenticated panel users with backup permissions to read or delete arbitrary files. Attackers can supply a base64-encoded backslash-separated payload to bypass PHP basename on Linux and access files outside the backup directory.

Detection Guidance

Check Formwork version with: grep -r "version" /path/to/formwork/vendor/getformwork/formwork/composer.json. If version is below 2.3.13, the system is vulnerable. Inspect BackupController.php for basename() usage; it should be replaced with Path::basename().

Look for unauthorized file access attempts in logs, especially requests containing base64-encoded backslash-separated paths like Li4vLi4vLi4vLi4vLi4v etc.

Impact Analysis

An attacker with backup permissions could read sensitive files like configuration files or delete critical system files. This could lead to data breaches, system instability, or unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches.

Mitigation Strategies

Upgrade Formwork to version 2.3.13 or later immediately. If upgrading is not possible, apply the patch from commit 89e7821a6fcee89474cd401b3dde0c1dccb0687f manually to BackupController.php.

Disable backup download and delete permissions for non-admin users until patched. Monitor file access logs for suspicious activity involving path traversal attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart