CVE-2026-104478: Formwork before 2.3.13 Path Traversal via BackupController Download and Delete
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be an authenticated Formwork panel user and have permission to download or delete backups. The issue is therefore exposed where those permissions are granted to untrusted or lower-privileged panel accounts.
What input is required to exploit the traversal?
The attacker supplies a base64-encoded path traversal payload using backslash-separated path components. This bypasses PHP basename handling on Linux and can target files outside the backup directory.
What is the impact of the two affected backup operations?
The backup download operation can be used to read arbitrary files, while the backup delete operation can be used to delete arbitrary files. Integrity impact is limited to deletion, and availability can be affected by deleting targeted files.
Which versions are affected?
Formwork versions before 2.3.13 are affected. Updating to 2.3.13 or later addresses the stated affected version range.