CVE-2026-54178: Backpack CRUD Path Traversal Vulnerability

CVE-2026-54178 Overview

CVE-2026-54178 is a path traversal vulnerability [CWE-22] in backpack/crud, a Laravel package that provides Create, Read, Update, and Delete (CRUD) functions for building administration panels. The flaw resides in the HasUploadFields::uploadMultipleFilesToDisk method in src/app/Models/Traits/HasUploadFields.php. The method trusts disk-relative paths submitted through the clear_<attribute>[] parameter and passes them directly to Storage::disk()->delete without verifying that the path belongs to the current model record. An authenticated user with Update permissions on any affected CRUD can delete arbitrary files on the configured disk, including attachments belonging to other records, shared assets, or other operational files.

Critical Impact
Authenticated users with Update access can destroy files owned by other records or shared operational assets on the configured storage disk, causing data loss and service disruption without needing to read the deleted files.

Affected Products

backpack/crud versions prior to 6.8.12
backpack/crud versions prior to 7.0.35 in the 7.x line
backpack/crud 5.x line through its final releases (remains affected, no fix)

Discovery Timeline

2026-09-14 - CVE-2026-54178 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-54178

Vulnerability Analysis

The vulnerability affects the multi-file upload mutator exposed through CrudTrait in src/app/Models/Traits/CrudTrait.php. When a user updates a record that uses the legacy multi-file upload field, the request may include a clear_<attribute>[] array containing filenames marked for removal. The uploadMultipleFilesToDisk method iterates over that user-controlled array and calls \Storage::disk($disk)->delete($filename) on each entry. Because the code never verifies that the submitted paths appear in the current record's persisted file list, an attacker can submit the path of any file on the configured disk and have it deleted.

The newer MultipleFiles uploader is not affected because it intersects requested deletions against the record's persisted file list before performing filesystem operations. The vulnerability does not disclose file contents; it only permits deletion.

Root Cause

The root cause is a missing ownership check between user-supplied file paths and the model record being edited. The vulnerable loop trusts the client-provided $files_to_clear array as the authoritative source of what should be deleted, rather than trusting only the record's own attribute value on the server.

Attack Vector

An authenticated user with Update access to any CRUD using the affected mutator submits a crafted update request. The request includes a clear_<attribute>[] parameter containing the disk-relative path of a file owned by another record or a shared asset. The backend deletes the file from the configured storage disk. No user interaction beyond an authenticated update request is required, and privileges limited to editing a single record are sufficient to affect files across the disk.

php

// Security patch in src/app/Models/Traits/HasUploadFields.php (PRs #5982, #5983)
// The fix iterates the record's own persisted attribute value and only
// deletes files that are both owned by the record AND requested for removal.

        // if a file has been marked for removal,
        // delete it from the disk and from the db
        // only delete files that are actually owned by this model record
        if ($files_to_clear) {
            foreach ($attribute_value as $filename) {
                if (in_array($filename, $files_to_clear)) {
                    \Storage::disk($disk)->delete($filename);
                    $attribute_value = Arr::where($attribute_value, function ($value, $key) use ($filename) {
                        return $value != $filename;
                    });
                }
            }
        }
// Source: https://github.com/Laravel-Backpack/CRUD/commit/0c7e095a869b8d1bd5668b1370a83b148e75bf4e

Detection Methods for CVE-2026-54178

Indicators of Compromise

Unexpected DELETE operations recorded in storage disk logs (S3, local filesystem, or other Laravel Storage drivers) that do not correspond to a legitimate record's owned files.
HTTP POST or PUT update requests to Backpack CRUD endpoints containing clear_*[] parameters with paths referencing filenames outside the target record's attachments.
Missing files reported by application users that were not deleted through normal administrative workflow.

Detection Strategies

Review web server and application logs for update requests that include clear_ parameters, and correlate the submitted paths against each record's persisted attribute values.
Enable Laravel query logging or an audit trail on models using HasUploadFields to identify mismatches between deleted files and the acting record.
Instrument the Storage::disk()->delete() call sites with logging that captures the acting user, target record ID, and file path.

Monitoring Recommendations

Enable object-level access logging on cloud storage backends (for example, AWS S3 server access logs or CloudTrail data events) to attribute deletions to specific application requests.
Alert on any authenticated Backpack user whose update requests trigger deletions of files not associated with their edited record.
Track the volume of file deletion operations per user session and alert on anomalous spikes.

How to Mitigate CVE-2026-54178

Immediate Actions Required

Upgrade backpack/crud to 6.8.12 on the 6.x line or 7.0.35 on the 7.x line immediately.
Migrate applications running on the 5.x line to a supported, patched release, as 5.x remains affected through its final releases.
Audit Backpack admin user roles and reduce Update permissions on CRUDs that use multi-file upload fields until patching is complete.

Patch Information

The vulnerability is fixed in backpack/crud6.8.12 and 7.0.35. The fix is implemented in commits 0c7e095 and baae042 through pull requests #5982 and #5983. Full details are available in the GitHub Security Advisory GHSA-8xjm-wqrp-2f25.

Workarounds

Migrate affected CRUDs from the legacy multi-file mutator to the newer MultipleFiles uploader, which validates deletions against the record's persisted file list.
Restrict Update permissions on affected CRUDs to trusted administrators only until upgrades are applied.
Enable storage backend versioning or soft-delete features so that inadvertently or maliciously deleted files can be restored.

bash

# Upgrade backpack/crud via Composer to a patched release
composer require backpack/crud:^7.0.35
# Or for the 6.x line
composer require backpack/crud:^6.8.12

# Verify installed version
composer show backpack/crud | grep versions