{"id":"CVE-2026-104478","summary":"Formwork before 2.3.13 Path Traversal via BackupController Download and Delete","details":"Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.","modified":"2026-10-04T02:46:39.804268335Z","published":"2026-10-02T23:28:48.001Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104478.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104478.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104478"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/formwork-before-2.3.13-path-traversal-via-backupcontroller-download-and-delete"},{"type":"FIX","url":"https://github.com/getformwork/formwork/commit/89e7821a6fcee89474cd401b3dde0c1dccb0687f"},{"type":"PACKAGE","url":"https://github.com/getformwork/formwork"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/getformwork/formwork","events":[{"introduced":"0"},{"fixed":"f9dabf727caa11de74e5cd672a6716dad3a321d9"},{"fixed":"89e7821a6fcee89474cd401b3dde0c1dccb0687f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.3.13"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["2.3.12","2.3.11","2.3.10","2.3.9","2.3.8","2.3.7","2.3.6","2.3.5","2.3.4","2.3.3","2.3.2","2.3.1","2.3.0","2.2.2","2.2.1","2.2.0","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0.1","2.0.0","2.0.0-rc.1","2.0.0-beta.6","2.0.0-beta.5","2.0.0-beta.4","2.0.0-beta.3","2.0.0-beta.2","2.0.0-beta.1","1.11.0","1.10.3","1.10.2","1.10.1","1.10.0","1.9.1","1.9.0","1.8.0","1.7.1","1.7.0","1.6.1","1.6.0","1.5.2","1.5.1","1.5.0","1.4.7","1.4.6","1.4.5","1.4.4","1.4.3","1.4.2","1.4.1","1.4.0","1.3.1","1.3.0","1.2.1","1.2.0","1.1.1","1.1.0","1.0.0","0.12.1","0.12.0","0.11.2","0.11.1","0.11.0","0.10.5","0.10.4","0.10.3","0.10.2","0.10.1","0.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104478.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N"}]}