CVE-2026-54178: Path Traversal
Summary
HasUploadFields::uploadMultipleFilesToDisk (in src/app/Models/Traits/HasUploadFields.php) reads file paths from the clear<attribute>[] request input and deletes them from the configured storage disk without verifying that the paths belong to the current model record.
An authenticated user with Update access on any CRUD that wires uploadMultipleFilesToDisk as a model mutator (the pattern documented in the v5.x uploadmultiple field guide) can supply arbitrary disk-relative paths in clear<attr>[] to delete files that were never associated with the record they are editing.
The safe pattern already exists in the codebase: src/app/Library/Uploaders/MultipleFiles.php intersects the requested deletions against the files currently stored in the database column before calling Storage::disk()->delete(). The trait method lacks that intersection.
Affected code
- src/app/Models/Traits/HasUploadFields.php — uploadMultipleFilesToDisk (primary sink) - src/app/Models/Traits/CrudTrait.php — mixes HasUploadFields into all Backpack-managed models
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases.
Impact
An attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted).
CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H = 8.1 High
Fix
Intersect $filestoclear against the filenames currently persisted on the model before calling delete(), mirroring the logic already present in MultipleFiles::uploadFiles. Fixed in 6.8.12 and 7.0.35.
Deployments still using the uploadMultipleFilesToDisk mutator pattern from the v5.x docs should migrate to the Uploader API (MultipleFiles::class via config/backpack/crud.php), which applies the safe intersection automatically.
Credits
Reported by Vishal Shukla (@shukla304).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/backpack/crudto a version that resolves this vulnerability.Fixed in 7.0.35 - Upgrade
Upgrade
composer/backpack/crudto a version that resolves this vulnerability.Fixed in 6.8.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.8.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.35 - Configuration
In `HasUploadFields::uploadMultipleFilesToDisk`, add the missing intersection check: take `$files_to_clear` from `clear_<attribute>[]`, intersect it with the model's currently persisted stored filenames/column values, then call `delete()` only on the intersected set (mirroring the logic in `src/app/Library/Uploaders/MultipleFiles.php` `uploadFiles`).
HasUploadFields::uploadMultipleFilesToDisk (src/app/Models/Traits/HasUploadFields.php) clear_<attribute>[] deletion logic = Intersect `$files_to_clear` with the filenames currently persisted on the model before calling `delete()` (i.e., only delete paths that belong to the current record).
Event History
Frequently Asked Questions
Which applications are exposed in practice?
Affected deployments are those using Backpack CRUD 5.x, 6.x before 6.8.12, or 7.x before 7.0.35, where a CRUD model uses the uploadMultipleFilesToDisk mutator for an upload_multiple field. The affected trait is mixed into Backpack-managed models through CrudTrait.
What access does an attacker need?
An attacker needs an authenticated account with Update access to any affected CRUD. No user interaction is required, and the attacker can submit disk-relative paths through the clear_<attribute>[] request input.
What can be done if upgrading is not immediately possible?
Modify the deletion logic so requested paths are intersected with the files currently stored in the model's database column before calling Storage::disk()->delete(). The existing MultipleFiles uploader implements this safer pattern.
Which versions contain fixes?
The issue is fixed in Backpack CRUD 6.8.12 and 7.0.35. All 5.x releases are listed as affected.