Laravel-Backpack CRUD up to 5.x/6.8.11/7.0.34 Upload HasUploadFields.php uploadMultipleFilesToDisk clear_[] path traversal

Summaryinfo

A vulnerability labeled as problematic has been found in Laravel-Backpack CRUD up to 5.x/6.8.11/7.0.34. This affects the function HasUploadFields::uploadMultipleFilesToDisk of the file src/app/Models/Traits/HasUploadFields.php of the component Upload. Such manipulation of the argument clear_[] leads to path traversal. This vulnerability is listed as CVE-2026-54178. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Laravel-Backpack CRUD up to 5.x/6.8.11/7.0.34. It has been rated as problematic. Affected by this issue is the function HasUploadFields::uploadMultipleFilesToDisk of the file src/app/Models/Traits/HasUploadFields.php of the component Upload. The manipulation of the argument clear_[] with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity, and availability. CVE summarizes:

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_<attribute>[] and passes them to Storage::disk()->delete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator through src/app/Models/Traits/CrudTrait.php can delete another record's attachment, a shared asset, or another operational file on the configured disk by submitting its path. The newer MultipleFiles uploader is not affected because it intersects requested deletions with the record's persisted file list. This flaw does not permit reading the deleted files. The 5.x line remains affected through its final releases. This issue is fixed in versions 6.8.12 and 7.0.35.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-54178 since 06/11/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

By approaching the search of inurl:src/app/Models/Traits/HasUploadFields.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 6.8.12 or 7.0.35 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Laravel-Backpack

Name

• CRUD

Version

• 5.x
• 6.8.0
• 6.8.1
• 6.8.2
• 6.8.3
• 6.8.4
• 6.8.5
• 6.8.6
• 6.8.7
• 6.8.8
• 6.8.9
• 6.8.10
• 6.8.11
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 7.0.13
• 7.0.14
• 7.0.15
• 7.0.16
• 7.0.17
• 7.0.18
• 7.0.19
• 7.0.20
• 7.0.21
• 7.0.22
• 7.0.23
• 7.0.24
• 7.0.25
• 7.0.26
• 7.0.27
• 7.0.28
• 7.0.29
• 7.0.30
• 7.0.31
• 7.0.32
• 7.0.33
• 7.0.34

Website

• Product: https://github.com/Laravel-Backpack/CRUD/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion