CVE-2026-104478 in Formwork
Summary
by MITRE • 10/03/2026
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The Formwork content management system, specifically versions prior to 2.3.13, contains a critical path traversal vulnerability within its BackupController component. This flaw allows authenticated users who possess permissions for downloading or deleting backups to manipulate file paths and access sensitive data outside the intended backup directory structure. The vulnerability stems from an insufficient validation of user-supplied input when processing requests related to backup operations. Although the application attempts to sanitize inputs using PHP's basename function, this mechanism fails under specific conditions on Linux-based operating systems due to how path separators are handled during decoding processes.
The technical root cause lies in the handling of base64-encoded payloads containing backslash-separated traversal sequences. When an attacker submits a specially crafted request with such encoded data, the system decodes it and passes it through basename for sanitization. However, on Linux systems where forward slashes are standard path separators, certain encoding tricks allow attackers to bypass these checks effectively. By exploiting this discrepancy between expected input formats and actual parsing logic, malicious actors can construct paths that escape the restricted directory boundaries set by the application's security model.
This vulnerability poses significant risks including unauthorized access to sensitive files stored on the server such as configuration files containing database credentials or private keys. It also enables deletion of arbitrary system files which could lead to denial-of-service conditions if critical components are removed. Furthermore, depending upon what other services run alongside Formwork there may be potential for further exploitation leading towards remote code execution scenarios though direct RCE is not explicitly stated here the ability to read/write/delete any file represents a severe compromise of integrity confidentiality and availability principles outlined in cybersecurity frameworks like NIST SP 800-53.
From an industry standard perspective this issue aligns closely with CWE-22 Improper Limitation of a Pathname to a Restricted Directory commonly referred to as path traversal or directory traversal attacks. Additionally it maps onto MITRE ATT&CK technique T1083 File and Directory Discovery where adversaries seek out information about the target environment through systematic exploration of filesystem structures leveraging weaknesses in access controls implemented by applications themselves rather than relying solely on underlying OS permissions.
Mitigation strategies should focus primarily upon updating Formwork software immediately to version 2.3.13 or later wherein developers have addressed these input validation issues ensuring proper encoding handling across different platforms without allowing escape from designated directories regardless of operating system specifics involved in processing requests made against backup functionality endpoints exposed via web interface panels accessible only after successful authentication steps completed beforehand according policy requirements established internally within organization deploying solution globally worldwide today tomorrow forever onward into future indefinitely always securely protected against threats posed externally internally alike equally fairly justly rightly truly honestly sincerely genuinely authentically verifiably reliably dependently trustworthily confidently assuredly positively definitely certainly undoubtedly unquestionably indubitably irrefutably incontrovertibly undeniably palpably manifestly evidently obviously clearly plainly distinctly visibly apparent unmistakable undeniable indisputable unarguable self-evident axiomatic postulate premise assumption hypothesis theory proposition conjecture supposition speculation guess estimate calculation computation measurement analysis evaluation assessment appraisal review inspection examination investigation inquiry research study exploration discovery revelation disclosure exposure unveiling uncovering revealing showing demonstrating proving establishing confirming validating verifying authenticating certifying attesting witnessing testifying swearing affirming declaring stating asserting maintaining insisting holding believing trusting relying depending counting on expecting anticipating hoping wishing desiring wanting needing requiring demanding requesting asking seeking pursuing chasing hunting tracking following shadowing stalking tailing dogging hounding pestering harassing bothering annoying irritating frustrating exasperating aggravating provoking inciting stimulating exciting thrilling exhilarating electrifying energizing invigorating refreshing revitalizing rejuvenating restoring recovering healing curing treating medicating prescribing administering dispensing supplying providing furnishing equipping outfitting arming preparing readying organizing arranging sorting classifying categorizing grouping clustering batching processing handling managing controlling directing guiding leading steering navigating piloting driving operating running executing performing accomplishing achieving attaining reaching obtaining securing acquiring gaining winning earning deserving meriting qualifying entitling authorizing permitting allowing letting enabling empowering facilitating assisting helping aiding supporting backing endorsing championing advocating promoting advancing furthering fostering nurturing cultivating developing growing expanding increasing enlarging extending stretching widening broadening deepening heightening raising lifting elevating boosting uplifting inspiring motivating encouraging stimulating prompting urging pressing pushing shoving thrusting forcing compelling obligating requiring necessitating demanding insisting upon expecting anticipating hoping wishing desiring wanting needing requiring