Formwork CVE-2026-104478

Requires an authenticated Formwork panel account that has been granted the backup download or backup delete permission (PR:L) - not available to anonymous visitors. The target must be a Linux deployment, because the bypass relies on PHP basename() on Linux not treating the backslash as a directory separator; the exploit uses a base64-encoded, backslash-separated traversal string passed to BackupController's download/delete routes. Limiting factors: the permission requirement, the Linux-specific basename behavior, and the fact that impact is confined to file read and file deletion (no write/code execution). The backup path must be configured (system.backup.path), which is a normal default of the product.

This is a credible but moderate-priority issue rather than an emergency. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L, 7.1) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated panel user (PR:L) who already holds backup download or delete permission - a meaningful barrier that keeps this out of the mass-exploitation category. The primary impact is high confidentiality (arbitrary file read, e.g. config files holding credentials/secrets) with a secondary low availability impact (arbitrary file deletion); there is no code execution or integrity write primitive. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of active or probable exploitation - consistent with a recently patched flaw in a niche product. A fix commit (89e7821) is confirmed in the official getformwork/formwork repository and the VulnCheck advisory corroborates the affected-version boundary (before 2.3.13). Note one platform caveat worth verifying operationally: the bypass is described as working specifically on Linux, because PHP's basename() does not treat the backslash as a path separator there, so Windows/other deployments may not be exploitable via the same payload.

An attacker who has obtained a low-privilege Formwork panel account carrying backup download or delete permission (for example a compromised or over-provisioned editor account) crafts a base64-encoded, backslash-separated traversal payload for the backup parameter. On a Linux host, PHP basename() fails to strip the backslash-based traversal, so the request resolves outside the backup directory, letting the attacker read sensitive files such as configuration or credential files, or delete arbitrary files. No public exploit code was identified in the provided data, though the patch diff plainly reveals the vulnerable logic.