Executive brief
Laravel Backpack CRUD is a popular admin panel generator for Laravel applications. A vulnerability in its file upload handling allows authenticated users with limited edit permissions (e.g., content editors) to delete any file stored on the application's configured disk, including files belonging to other records or system assets. This could result in significant data loss or disruption to application functionality.
Technical details
The vulnerability resides in HasUploadFields::uploadMultipleFilesToDisk (src/app/Models/Traits/HasUploadFields.php), which processes the clear_<attribute>[] request parameter to delete files without intersecting against the files currently persisted in the database column for the model record. An authenticated user with low-privilege Backpack admin access (Update permission on any CRUD using the uploadMultipleFilesToDisk mutator pattern) can craft requests with arbitrary disk-relative file paths in clear_<attr>[] parameters to delete files unrelated to their record. The safe pattern already exists in the codebase (MultipleFiles::uploadFiles) and validates deletions against stored filenames before calling Storage::disk()->delete(); the trait method lacks this validation. The fix, deployed in 6.8.12 and 7.0.35, adds the intersection logic. Users on affected versions should either upgrade or migrate to the Uploader API (MultipleFiles::class), which applies the validation automatically.
Affected products
- Laravel Backpack CRUD 5.0.0 through 5.x (no patch available), 6.0.0 through 6.8.11, 7.0.0 through 7.0.34
Timeline
- 2026-06-15: disclosed: Published to GitHub Advisory Database
- 2026-08-20: advisory: Advisory reviewed and published
- 2026: patched: Fixed in versions 6.8.12 and 7.0.35