CVE-2026-104478

High

Description

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.

SeverityHigh

CVSS7.1

Exploit probability—

ProductFormwork

PublishedOct 3, 2026

First seenOct 3, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

getformwork formwork2.3.13 or later

Patches

github.com/getformwork/formwork/commit/89e7821a6fcee89474cd401b3dde0c1dccb0687f

Affected products

Product	Affected versions	Fixed in
getformwork formwork	v < 2.3.13	2.3.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.