Arbitrary File Deletion in Backpack for Laravel

Backpack for Laravel contains a high-severity insecure direct object reference (IDOR) vulnerability, tracked as CVE-2026-54178, affecting the HasUploadFields::uploadMultipleFilesToDisk method. This method, utilized primarily in v5.x implementations and supported in subsequent versions for backward compatibility, processes file deletion requests from the clear_<attribute>[] input parameter without verifying that the requested file paths are associated with the record currently being modified.

An authenticated user with sufficient permissions to update CRUD models can supply arbitrary, disk-relative paths within this request parameter, forcing the application to delete files that were never associated with their account or the specific record. This vulnerability bypasses authorization logic, allowing for widespread file deletion, which can result in significant service disruption or data loss. The issue is resolved by implementing file path intersection logic, which ensures only existing model-associated files are targeted for deletion. Users are encouraged to migrate to the modern Uploader API to mitigate this risk.

Impact

Successful exploitation allows a low-privilege attacker (e.g., a content editor) to delete any file residing on the application's configured storage disk. This impacts the integrity and availability of shared assets, application attachments, and operational files. There is no associated confidentiality impact, as the vulnerability does not permit the reading of file contents. Affected environments include all 5.x releases, 6.x versions prior to 6.8.12, and 7.x versions prior to 7.0.35.

Recommendation

• Upgrade the backpack/crud package to version 6.8.12, 7.0.35, or higher to apply the security fix.
• Migrate all legacy uploadMultipleFilesToDisk model mutator patterns to the new Uploader API (MultipleFiles class) as defined in the Backpack documentation.
• Audit storage disk access logs for anomalous, high-frequency deletion requests originating from administrative endpoints.
• Restrict administrative access to CRUD operations to trusted users only to minimize the risk of malicious file deletion.