GHSA-8xjm-wqrp-2f25: Path Traversal
Summary
HasUploadFields::uploadMultipleFilesToDisk (in src/app/Models/Traits/HasUploadFields.php) reads file paths from the clear<attribute>[] request input and deletes them from the configured storage disk without verifying that the paths belong to the current model record.
An authenticated user with Update access on any CRUD that wires uploadMultipleFilesToDisk as a model mutator (the pattern documented in the v5.x uploadmultiple field guide) can supply arbitrary disk-relative paths in clear<attr>[] to delete files that were never associated with the record they are editing.
The safe pattern already exists in the codebase: src/app/Library/Uploaders/MultipleFiles.php intersects the requested deletions against the files currently stored in the database column before calling Storage::disk()->delete(). The trait method lacks that intersection.
Affected code
- src/app/Models/Traits/HasUploadFields.php — uploadMultipleFilesToDisk (primary sink) - src/app/Models/Traits/CrudTrait.php — mixes HasUploadFields into all Backpack-managed models
The vulnerability is present in all 5.x, 6.x < 6.8.12, and 7.x < 7.0.35 releases.
Impact
An attacker with low-privilege Backpack admin access (e.g. a content editor) can delete any file under the configured disk root: other records' attachments, shared assets, or files placed on the same disk for operational purposes. No confidentiality impact (files cannot be read, only deleted).
CWE-285 (Authorization Bypass) / CWE-639 (IDOR on file deletion) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H = 8.1 High
Fix
Intersect $filestoclear against the filenames currently persisted on the model before calling delete(), mirroring the logic already present in MultipleFiles::uploadFiles. Fixed in 6.8.12 and 7.0.35.
Deployments still using the uploadMultipleFilesToDisk mutator pattern from the v5.x docs should migrate to the Uploader API (MultipleFiles::class via config/backpack/crud.php), which applies the safe intersection automatically.
Credits
Reported by Vishal Shukla (@shukla304).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/backpack/crudto a version that resolves this vulnerability.Fixed in 7.0.35 - Upgrade
Upgrade
composer/backpack/crudto a version that resolves this vulnerability.Fixed in 6.8.12 - Upgrade
Upgrade
backpackto a version that resolves this vulnerability.Fixed in 6.8.12 - Upgrade
Upgrade
backpackto a version that resolves this vulnerability.Fixed in 7.0.35 - Configuration
Before deleting, validate/sanitize the requested deletions by intersecting `$files_to_clear` against the filenames currently persisted on the edited model (mirroring the logic in `src/app/Library/Uploaders/MultipleFiles.php` / `MultipleFiles::uploadFiles`).
HasUploadFields trait (`src/app/Models/Traits/HasUploadFields.php`), method `uploadMultipleFilesToDisk` clear_<attribute>[] deletion logic = Intersect `$files_to_clear` with the filenames currently persisted on the model record before calling `delete()`
Event History
Frequently Asked Questions
Which deployments are exposed?
All 5.x releases are affected, as are 6.x releases before 6.8.12 and 7.x releases before 7.0.35. Exploitation additionally requires a CRUD whose model uses uploadMultipleFilesToDisk as a mutator for an upload_multiple field.
What access does an attacker need?
The attacker must be authenticated and have Update access to any affected CRUD. They do not need user interaction; they can provide disk-relative paths through the clear_<attribute>[] request input.
What can an attacker delete?
They can request deletion of arbitrary paths on the configured storage disk, rather than being limited to files associated with the record they are editing. The vulnerable trait does not verify requested paths against the model's database column.
How can I identify potentially affected CRUDs?
Review Backpack-managed models that use CrudTrait and determine whether uploadMultipleFilesToDisk is wired as a model mutator, particularly where the v5.x upload_multiple field pattern is used. Review whether users with Update access can submit clear_<attribute>[] values for those fields.
What behavior should remediation enforce?
Deletion requests should be intersected with the files currently stored in the relevant model database column before Storage::disk()->delete() is called. The MultipleFiles uploader already uses this validation pattern.