Directory Traversal Vulnerability in Backpack for Laravel Products
CVE-2026-54178
8.1HIGH
What is CVE-2026-54178?
A directory traversal vulnerability in Backpack for Laravel allows authenticated users with Update access to delete files from other records without proper validation. The flaw arises when the HasUploadFields::uploadMultipleFilesToDisk method does not verify that the disk-relative paths submitted by users correspond with those on the current model record. This can lead to unintended data loss, as users could target shared assets or operational files. Fortunately, this issue is addressed in versions 6.8.12 and 7.0.35, whereas the 5.x line remains vulnerable. To mitigate risks, updating to fixed versions is crucial.
Affected Version(s)
CRUD >= 5.0.0, < 6.0.0 < 5.0.0, 6.0.0
CRUD >= 6.0.0, < 6.8.12 < 6.0.0, 6.8.12
CRUD >= 7.0.0, < 7.0.35 < 7.0.0, 7.0.35