{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/backpack-for-laravel/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Backpack CRUD (5.x, 6.x \u003c 6.8.12, 7.x \u003c 7.0.35)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Backpack for Laravel"],"content_html":"\u003cp\u003eBackpack for Laravel contains a high-severity insecure direct object reference (IDOR) vulnerability, tracked as CVE-2026-54178, affecting the \u003ccode\u003eHasUploadFields::uploadMultipleFilesToDisk\u003c/code\u003e method. This method, utilized primarily in v5.x implementations and supported in subsequent versions for backward compatibility, processes file deletion requests from the \u003ccode\u003eclear_\u0026lt;attribute\u0026gt;[]\u003c/code\u003e input parameter without verifying that the requested file paths are associated with the record currently being modified.\u003c/p\u003e\n\u003cp\u003eAn authenticated user with sufficient permissions to update CRUD models can supply arbitrary, disk-relative paths within this request parameter, forcing the application to delete files that were never associated with their account or the specific record. This vulnerability bypasses authorization logic, allowing for widespread file deletion, which can result in significant service disruption or data loss. The issue is resolved by implementing file path intersection logic, which ensures only existing model-associated files are targeted for deletion. Users are encouraged to migrate to the modern Uploader API to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privilege attacker (e.g., a content editor) to delete any file residing on the application's configured storage disk. This impacts the integrity and availability of shared assets, application attachments, and operational files. There is no associated confidentiality impact, as the vulnerability does not permit the reading of file contents. Affected environments include all 5.x releases, 6.x versions prior to 6.8.12, and 7.x versions prior to 7.0.35.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003ebackpack/crud\u003c/code\u003e package to version 6.8.12, 7.0.35, or higher to apply the security fix.\u003c/li\u003e\n\u003cli\u003eMigrate all legacy \u003ccode\u003euploadMultipleFilesToDisk\u003c/code\u003e model mutator patterns to the new Uploader API (\u003ccode\u003eMultipleFiles\u003c/code\u003e class) as defined in the Backpack documentation.\u003c/li\u003e\n\u003cli\u003eAudit storage disk access logs for anomalous, high-frequency deletion requests originating from administrative endpoints.\u003c/li\u003e\n\u003cli\u003eRestrict administrative access to CRUD operations to trusted users only to minimize the risk of malicious file deletion.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T19:13:48Z","date_published":"2026-08-20T19:13:48Z","id":"https://feed.craftedsignal.io/briefs/2026-08-laravel-backpack-idor/","summary":"An insecure direct object reference vulnerability in the HasUploadFields trait of Backpack for Laravel allows authenticated users to delete arbitrary files on the configured storage disk via manipulated request parameters.","title":"Arbitrary File Deletion in Backpack for Laravel","url":"https://feed.craftedsignal.io/briefs/2026-08-laravel-backpack-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Backpack for Laravel","version":"https://jsonfeed.org/version/1.1"}