CVE-2026-54178— backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
Quick assessment
Affected
Laravel-Backpack CRUD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
backpack/crud 为 Backpack（一套帮助用户构建自定义管理后台的 Laravel 包集合）提供增、查、改、删（CRUD）功能。 在版本 6.8.12 和 7.0.35 之前， 中的 方法会信任来自 的磁盘相对路径，并直接将其传递给 ，而未验证这些路径是否确实对应当前模型记录所持久化的文件。 通过 使用该修饰器的 CRUD 接口中，拥有“更新”权限的已认证用户，可以通过提交其他记录附件、共享资源或配置磁盘上其他操作文件的磁盘相对路径，从而删除这些不属于当前记录的文件。 较新的 MultipleFil
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Laravel-Backpack | CRUD | >= 5.0.0, < 6.0.0 |
affected |
>= 6.0.0, < 6.8.12 |
affected | ||
>= 7.0.0, < 7.0.35 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54178
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
Source: CVE Program / CVE List V5
Vulnerability Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_<attribute>[] and passes them to Storage::disk()->delete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator through src/app/Models/Traits/CrudTrait.php can delete another record's attachment, a shared asset, or another operational file on the configured disk by submitting its path. The newer MultipleFiles uploader is not affected because it intersects requested deletions with the record's persisted file list. This flaw does not permit reading the deleted files. The 5.x line remains affected through its final releases. This issue is fixed in versions 6.8.12 and 7.0.35.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Laravel-Backpack | CRUD | >= 5.0.0, < 6.0.0 | - |
|
II. Public POCs for CVE-2026-54178
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54178
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54178 (5)
-
🔗 fix loop by pxpm · Pull Request #5983 · Laravel-Backpack/CRUD x_refsource_MISC
-
🔗 fix loop by pxpm · Pull Request #5982 · Laravel-Backpack/CRUD x_refsource_MISC
-
🔗 Release 6.8.12 🌈 · Laravel-Backpack/CRUD · GitHub x_refsource_MISC
-
-
Vendor Advisories for CVE-2026-54178 (1)
Vendor Pages for CVE-2026-54178 (1)
-
🔗 Release 7.0.35 🌈 · Laravel-Backpack/CRUD · GitHub x_refsource_MISC
Same Patch Batch · Laravel-Backpack · 2026-09-14 · 8 CVEs total
| CVE-2026-54182 | 8.1 HIGH | backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host |
| CVE-2026-54175 | 7.6 HIGH | backpack/crud: Unverified password change in MyAccountController via mass assignment |
| CVE-2026-54180 | 7.6 HIGH | backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cr |
| CVE-2026-54177 | 6.6 MEDIUM | backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk up |
| CVE-2026-54176 | 6.5 MEDIUM | backpack/crud: MyAccountController allows changing the login email without a current-passw |
| CVE-2026-57570 | 6.5 MEDIUM | backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (I |
| CVE-2026-54181 | 5.4 MEDIUM | backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are |
IV. Related Vulnerabilities
Same product: CRUD
-
CVE-2026-54181
backpack/crud: Stored XSS in the color column — the `@if($co -
CVE-2026-54177
backpack/crud: HasUploadFields keeps the attacker-supplied f -
CVE-2026-54176
backpack/crud: MyAccountController allows changing the login -
CVE-2026-54180
backpack/crud: CRUD panel query scopes are not enforced on U -
CVE-2026-57570
backpack/crud: HasMany/MorphMany relation fields allow cross
Same vendor: Laravel-Backpack
-
CVE-2026-54181
backpack/crud: Stored XSS in the color column — the `@if($co -
CVE-2026-54177
backpack/crud: HasUploadFields keeps the attacker-supplied f -
CVE-2026-54176
backpack/crud: MyAccountController allows changing the login -
CVE-2026-54180
backpack/crud: CRUD panel query scopes are not enforced on U -
CVE-2026-57570
backpack/crud: HasMany/MorphMany relation fields allow cross
Same weakness: CWE-22
-
CVE-2026-50006
Anyquery: Arbitrary File Write (AFW) which could lead to Rem -
CVE-2026-54629
Anyquery: Local File Read (LFR) via Unrestricted SQLite Virt -
CVE-2026-47253
Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbi -
CVE-2026-16335
DataStage on Cloud Pak for Data has several vulnerabilities -
CVE-2026-73496
MCP Atlassian: Arbitrary server-side file read via attachmen
V. Comments for CVE-2026-54178
No comments yet