high · 8.1CVE-2026-54178Aug 20, 2026

CVE-2026-54178: Backpack CRUD Arbitrary File Deletion via Unvalidated clear_<attr>[] Input

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A low-privilege Backpack admin can delete any file on the storage disk by injecting arbitrary paths into the clear_<attribute>[] form parameter when editing any record that uses the upload_multiple…

Packagebackpack/crud
Ecosystemcomposer
Affected>= 5.0.0, < 6.0.0
CVE-2026-54178: Backpack CRUD Arbitrary File Deletion via Unvalidated clear_<attr>[] Input

The problem

The HasUploadFields::uploadMultipleFilesToDisk trait method in backpack/crud reads file paths directly from the clear_<attribute>[] request input and passes them straight to Storage::disk()->delete(). There is no check that the submitted paths actually belong to the record being edited.

Any authenticated user with Update access on a CRUD that wires uploadMultipleFilesToDisk as a model mutator (the standard v5.x upload_multiple pattern) can delete files belonging to other records, shared assets, or any file reachable under the configured disk root.

The impact is integrity and availability only; files cannot be read, only destroyed.

Proof of concept

A working proof-of-concept for CVE-2026-54178 in backpack/crud, with the exact payload below.

http
POST /admin/articles/1/edit HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
Cookie: backpack_session=<valid_session>

_token=<csrf_token>&_method=PUT&title=Normal+Edit&clear_photos[]=uploads%2Farticles%2F1%2Flegit.jpg&clear_photos[]=uploads%2Farticles%2F99%2Fother-record-file.pdf&clear_photos[]=shared%2Fassets%2Fimportant-document.pdf

The root cause is a missing ownership intersection in the trait method. The safe code path in MultipleFiles.php does: $filesToDelete = array_intersect($requestedDeletions, $currentDbValue) before calling Storage::disk()->delete(). The vulnerable uploadMultipleFilesToDisk skips that intersection entirely, trusting the attacker-supplied clear_photos[] array at face value.

Because Storage::disk()->delete() accepts any disk-relative path, paths outside the current record's folder (including other records' uploads or shared assets) are deleted unconditionally. CWE-639 (IDOR) applies because the user-supplied key selects a resource with no authorization check, and CWE-22 (Path Traversal) applies because no path-prefix restriction is enforced.

The fix

Upgrade to backpack/crud 6.8.12 (for 6.x installs) or 7.0.35 (for 7.x installs). The fix intersects $files_to_clear against the filenames currently persisted in the database column before calling delete(), matching the logic already present in MultipleFiles::uploadFiles.

Sites still using the legacy uploadMultipleFilesToDisk mutator pattern from the v5.x docs should migrate to the Uploader API (CRUD::field('photos')->type('upload_multiple')->withFiles()) which applies the safe intersection automatically. All 5.x deployments remain unpatched and should migrate immediately.

Reported by Vishal Shukla.

References: [1][2][3][4]

Related research