rootpwn

high · CVSS v3 7.1 · CVSS v4 7.1

CVE-2026-104478

Formwork versions prior to 2.3.13 have a path traversal flaw in BackupController that lets authenticated panel users read or delete arbitrar

Overview

Formwork versions prior to 2.3.13 have a path traversal flaw in BackupController that lets authenticated panel users read or delete arbitrary files. The vulnerability is triggered by a base64-encoded backslash-separated payload that bypasses PHP basename on Linux. It allows attackers with backup download or delete permissions to access files outside the backup directory.

Description

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.

Impact

Confidentiality: attackers can read sensitive files. Integrity: attackers can delete or modify files, potentially corrupting backups. Availability: removal of critical files may disrupt backup operations. The flaw affects authenticated panel users who have backup download or delete permissions.

Remediation

Apply the official patch to upgrade to Formwork 2.3.13 or later. If an upgrade is not immediately possible, disable the backup feature or remove backup download/delete permissions from all users. Additionally, validate and sanitize file paths on the server side, enforce a whitelist of allowed directories, and avoid using base64 decoding for path components.

Risk context

The vulnerability is rated high with a CVSS v3 score of 7.1. No EPSS data is available, but the flaw can be exploited by any authenticated user with backup permissions, making it a serious risk for organizations running affected Formwork versions.

Affected products

  • Formwork 2.3.12
  • Formwork 2.3.11
  • Formwork 2.3.10
  • Formwork 2.3.9
  • Formwork 2.3.8
  • Formwork 2.3.7
  • Formwork 2.3.6
  • Formwork 2.3.5

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.1
CVSS v4
7.1
EPSS
—

path-traversal backup authentication confidentiality integrity availability php formwork

← All CVEs

Related CVEs

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis

high

CVE-2026-104433

Mooncake Transfer Engine versions prior to 0.3.12 contain an out‑of‑bounds read in the readString function that can be triggered by an unauthenticated attacker sending a zero‑length handshake frame. The flaw causes the service to crash, potentially disrupting SGLang inference servers or other applications using the engine. It is a high‑severity vulnerability that can lead to denial of service.

View analysis

high

CVE-2026-104476

Backdrop CMS versions prior to 1.35.1 expose configuration export archives that remain on the server. An unauthenticated attacker can download these archives and view full site configuration, including sensitive settings. This vulnerability can leak administrative credentials and other secrets.

View analysis