Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-104478: Formwork up to 2.3.12 lets logged‑in users delete any file
CVE-2026-104478 · published 1 month ago
Summary
The Formwork content system versions before 2.3.13 let users who are signed into the admin panel and have backup permissions read or erase files anywhere on the server. This happens because the backup feature does not correctly check the file path that is requested. Upgrade to version 2.3.13 or later and limit backup permissions to only trusted administrators.
What to do
- Update getformwork formwork to version 2.3.13 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| getformwork | formwork | < 2.3.13 |
Original advisory text
Formwork before 2.3.13 Path Traversal via BackupController Download and Delete
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.
References
- https://github.com/getformwork/formwork/commit/89e7821a6fcee89474cd401b3dde0c1dc... Patch
- https://github.com/getformwork/formwork Product
- https://www.vulncheck.com/advisories/formwork-before-2.3.13-path-traversal-via-b... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-1044... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-104478 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.1
High
Type
CWE-22Path Traversal
Timeline
Published2 Oct 2026
Updated4 Nov 2026
First seen2 Oct 2026
Track software like this
Free during beta