high7.1
CVE-2026-104478
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files.
Impact
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.
Affected products
| Product | Affected versions |
|---|---|
| Formwork | before 2.3.13 |
Versions were read from the advisory text. No structured product data has been published for this record yet.