Cpe:2.3:a:getformwork:formwork:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3agetformworkformwork/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 03 Oct 2026 00:49:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPath Traversal Vulnerability in Formwork BackupControllerhttps://feed.craftedsignal.io/briefs/2026-10-formwork-path-traversal/Sat, 03 Oct 2026 00:49:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-formwork-path-traversal/Formwork prior to version 2.3.13 contains a path traversal vulnerability in the BackupController component allowing authenticated users to read or delete arbitrary files via base64-encoded payloads.Formwork versions prior to 2.3.13 are vulnerable to a path traversal vulnerability residing within the BackupController component. This vulnerability allows authenticated users who possess backup download or deletion permissions to escape the intended directory structure. By providing a base64-encoded, backslash-separated payload, an attacker can bypass the PHP basename validation logic on Linux-based installations. Successful exploitation permits an authenticated attacker to read sensitive configuration files or delete critical system files, potentially leading to full system compromise or service disruption. Defenders should prioritize updating to version 2.3.13 or later to remediate the underlying flaw in file handling.

Impact

Successful exploitation of CVE-2026-104478 allows an authenticated user to perform arbitrary file reads or deletions. This impacts the integrity and confidentiality of the Formwork installation and underlying server data. If the service is running with elevated privileges, the impact can extend to the broader system environment.

Recommendation

  • Upgrade Formwork to version 2.3.13 or later immediately to patch CVE-2026-104478.
  • Review access control lists for the administrative panel and restrict backup download and delete permissions to only the most trusted administrative accounts.
  • Audit web server access logs for requests to the BackupController endpoint that contain unusual, encoded, or backslash-heavy string patterns.
]]>highadvisorypath-traversalweb-vulnerabilitypatch-management