[ CVE-2026-104478 · Published 3 Oct 2026 ]
Vulnerability in getformwork formwork
CVSS 7.1
EPSS <1%No fix listed yet
[ Description ]Official description
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.