CVE-2026-54178: 
PHP vulnerability analysis and mitigation

CVE-2026-54178 is an arbitrary file deletion vulnerability in Laravel Backpack CRUD (backpack/crud) caused by missing authorization checks in HasUploadFields::uploadMultipleFilesToDisk. The flaw allows an authenticated low-privilege user to delete arbitrary files on the configured storage disk by supplying attacker-controlled paths in the clear_<attr>[] request parameter. Affected versions include all 5.x releases, 6.x before 6.8.12, and 7.x before 7.0.35. The vulnerability was originally reported by Vishal Shukla (@shukla304), published to the GitHub Advisory Database on August 20, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is a missing intersection check in src/app/Models/Traits/HasUploadFields.php: the uploadMultipleFilesToDisk method reads file paths directly from the clear_<attr>[] HTTP request input and passes them to Storage::disk()->delete() without verifying that the supplied paths correspond to files actually associated with the model record being edited (CWE-22, CWE-285, CWE-639). A safe pattern already exists in src/app/Library/Uploaders/MultipleFiles.php, which intersects requested deletions against filenames persisted in the database column before deletion — the trait method simply lacks this guard. Because CrudTrait.php mixes HasUploadFields into all Backpack-managed models, any CRUD endpoint that wires uploadMultipleFilesToDisk as a model mutator (the pattern documented in the v5.x upload_multiple field guide) is exposed. Exploitation requires only a valid authenticated session with Update access on any such CRUD endpoint (GitHub Advisory, Backpack Advisory).

A low-privilege Backpack admin user (e.g., a content editor) can delete any file reachable under the configured storage disk root — including other records' attachments, shared application assets, or operational files stored on the same disk. There is no confidentiality impact (files cannot be read, only deleted), but integrity and availability are both rated High: an attacker can corrupt application data by removing files belonging to unrelated records and can disrupt service availability by deleting critical assets. The scope is limited to the configured disk root, but depending on disk configuration this could encompass a broad set of application files (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available. Exploitation requires authenticated access with Update privileges on a CRUD endpoint using the vulnerable mutator pattern, which limits the attack surface to users who already have some level of admin access to the Backpack interface (GitHub Advisory).

1. Reconnaissance: Identify a Laravel application using backpack/crud versions 5.x, 6.x < 6.8.12, or 7.x < 7.0.35 with at least one CRUD endpoint that uses uploadMultipleFilesToDisk as a model mutator for an upload_multiple field.
2. Authenticate: Log in to the Backpack admin panel with any account that has Update (edit) access on the vulnerable CRUD resource.
3. Identify target files: Determine disk-relative paths of files to delete — these could be other records' attachments, shared assets, or configuration files stored on the same disk. File paths may be discoverable through other admin panel views or by inference from naming conventions.
4. Craft malicious request: Submit an HTTP POST/PUT request to the CRUD update endpoint for any record, injecting arbitrary disk-relative paths into the clear_<attr>[] parameter (e.g., clear_images[]=../../other-record/important-file.jpg).
5. Trigger deletion: The uploadMultipleFilesToDisk method processes the clear_<attr>[] input without validating ownership, calling Storage::disk()->delete() on the attacker-supplied paths and permanently removing the targeted files (GitHub Advisory, Backpack Advisory).

• Network: HTTP POST/PUT requests to Backpack CRUD update endpoints containing clear_<attr>[] parameters with paths that do not match files associated with the record being edited; paths containing ../ sequences or references to directories outside the expected upload folder.
• Logs: Laravel/application logs showing Storage::disk()->delete() calls for file paths inconsistent with the model record being updated; repeated update requests to the same CRUD endpoint with varying clear_ parameter values.
• File System: Unexpected disappearance of files under the configured storage disk root, particularly files belonging to records not recently edited; missing shared assets or files from directories outside normal upload paths.
• Application: Database records referencing file paths that no longer exist on disk, causing broken media or missing attachments across multiple unrelated records (GitHub Advisory).

Upgrade backpack/crud to version 6.8.12 (for 6.x deployments) or 7.0.35 (for 7.x deployments), which fix the vulnerability by intersecting $files_to_clear against filenames currently persisted in the database column before calling Storage::disk()->delete() (Release 6.8.12, Release 7.0.35). All 5.x deployments are affected and have no patched release; users on 5.x should migrate to the Uploader API (MultipleFiles::class via config/backpack/crud.php), which applies the safe intersection automatically. As an interim workaround, restrict Update access on CRUD endpoints using uploadMultipleFilesToDisk to fully trusted users only, or audit and remove the uploadMultipleFilesToDisk mutator pattern in favor of the safer Uploader API (Backpack Advisory).