# CVE-2026-54178: Laravel Backpack CRUD arbitrary file deletion in HasUploadFields

Source: https://junglewise.ai/threats/cve-2026-54178-laravel-backpack-crud-arbitrary-file-deletion-in-hasuploadfields  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54178 · Severity: high · CVSS 8.1 · Published 2026-09-14

Laravel Backpack CRUD is a popular admin panel generator for Laravel applications. A vulnerability in its file upload handling allows authenticated users with limited edit permissions (e.g., content editors) to delete any file stored on the application's configured disk, including files belonging to other records or system assets. This could result in significant data loss or disruption to application functionality.

Technologies: [backpack/crud (Packagist)](https://junglewise.ai/threats/technologies/backpack-crud). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-54178 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54178 being exploited in the wild.

**How severe is CVE-2026-54178?** High severity, with a CVSS score of 8.1, published 14 September 2026.

**Which products and versions are affected?** backpack/crud (Packagist) ECOSYSTEM:introduced=5.0.0.

**Is there a fix for CVE-2026-54178?** A patch was published on 2026: Fixed in versions 6.8.12 and 7.0.35 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54178 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-54178?** Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability resides in HasUploadFields::uploadMultipleFilesToDisk (src/app/Models/Traits/HasUploadFields.php), which processes the clear_<attribute>[] request parameter to delete files without intersecting against the files currently persisted in the database column for the model record. An authenticated user with low-privilege Backpack admin access (Update permission on any CRUD using the uploadMultipleFilesToDisk mutator pattern) can craft requests with arbitrary disk-relative file paths in clear_<attr>[] parameters to delete files unrelated to their record. The safe pattern already exists in the codebase (MultipleFiles::uploadFiles) and validates deletions against stored filenames before calling Storage::disk()->delete(); the trait method lacks this validation. The fix, deployed in 6.8.12 and 7.0.35, adds the intersection logic. Users on affected versions should either upgrade or migrate to the Uploader API (MultipleFiles::class), which applies the validation automatically.

## Affected products

- Laravel Backpack CRUD 5.0.0 through 5.x (no patch available), 6.0.0 through 6.8.11, 7.0.0 through 7.0.34

## Identifiers

- CVE-2026-54178
- GHSA-8xjm-wqrp-2f25

## Timeline

- 2026-06-15: disclosed: Published to GitHub Advisory Database
- 2026-08-20: advisory: Advisory reviewed and published
- 2026: patched: Fixed in versions 6.8.12 and 7.0.35

## References

- [https://api.github.com/users/therawdev](https://api.github.com/users/therawdev)
- [https://github.com/therawdev](https://github.com/therawdev)
- [https://api.github.com/users/therawdev/gists%7B/gist_id%7D](https://api.github.com/users/therawdev/gists%7B/gist_id%7D)
- [https://api.github.com/users/therawdev/repos](https://api.github.com/users/therawdev/repos)
- [https://avatars.githubusercontent.com/u/74800891?v=4](https://avatars.githubusercontent.com/u/74800891?v=4)
- [https://api.github.com/users/therawdev/events%7B/privacy%7D](https://api.github.com/users/therawdev/events%7B/privacy%7D)

## Related threats

- [Laravel Backpack CRUD authorization bypass in HasMany/MorphMany relations](https://junglewise.ai/threats/cve-2026-57570-laravel-backpack-crud-authorization-bypass-in-hasmany-morphmany)
- [Laravel Backpack CRUD OS command injection in Stats::makeCurlRequest](https://junglewise.ai/threats/cve-2026-54182-laravel-backpack-crud-os-command-injection-in-stats)
- [Laravel Backpack CRUD stored XSS in color column](https://junglewise.ai/threats/cve-2026-54181-laravel-backpack-crud-stored-xss-in-color-column)
- [Laravel Backpack CRUD authorization bypass in write operations](https://junglewise.ai/threats/cve-2026-54180-laravel-backpack-crud-authorization-bypass-in-write-operations)
- [Laravel Backpack CRUD file upload remote code execution](https://junglewise.ai/threats/cve-2026-54177-laravel-backpack-crud-file-upload-remote-code-execution)