---
id: CVE-2026-104478
title: >-
  Formwork before 2.3.13 contains a path traversal vulnerability in
  BackupController that allows authenticated panel users to read or delete
  arbitrary files
summary: >-
  Formwork before 2.3.13 contains a path traversal vulnerability in
  BackupController that allows authenticated panel users to read or delete
  arbitrary files. Attackers with backup download or delete permission can
  supply a base64-encoded b…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'
cwe:
  - CWE-22
vendor: getformwork
product: formwork
affected:
  - formwork < 2.3.13
published: '2026-10-03'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T00:16:36.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104478'
references:
  - url: 'https://github.com/getformwork/formwork'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/getformwork/formwork/commit/89e7821a6fcee89474cd401b3dde0c1dccb0687f
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/formwork-before-2.3.13-path-traversal-via-backupcontroller-download-and-delete
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-02T23:34:57.409Z'
---

## Overview

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.