Summary
A path traversal vulnerability in Formwork's BackupController allows authenticated panel users with backup permissions to access files outside the intended backup directory. Depending on the granted permission, an attacker may download or delete arbitrary files by supplying a crafted traversal path.
Affected context
The vulnerability occurs in Formwork deployments where the BackupController processes user-controlled backup paths for download or deletion. It becomes risky when an authenticated panel user has the corresponding backup permission and path validation relies on PHP basename behavior that does not adequately normalize backslash-separated traversal sequences on Linux.
Exploit preconditions
- Attack surface: Authenticated administrative or panel backup functionality
- Required access: A valid panel account with backup download or deletion permission
- Trigger point: Backup file retrieval or deletion through the BackupController
- Why exploitation is possible: User-supplied paths are insufficiently constrained to the backup directory, and backslash-separated traversal input can bypass the relevant basename-based protection on Linux
Why this happens
The underlying bug is improper restriction of user-controlled file paths. The application attempts to sanitize a requested path with a filename-oriented operation, but that control does not reliably canonicalize or reject alternate path separators and traversal components on the target platform. This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, because attacker-influenced paths can escape the directory boundary intended by the application.
Potential impact
- An attacker may read sensitive files available to the application process
- An attacker could delete application data, backups, or configuration files
- Exposure of credentials or secrets may enable further compromise
- Service availability could be affected by deletion of required files
- The application or host may experience broader compromise depending on file permissions
General mitigation guidance
Mitigation generally focuses on enforcing directory boundaries through canonical path handling rather than relying on filename stripping alone.
Common defensive patterns include:
- Resolve and validate candidate paths against a fixed, trusted backup directory
- Reject traversal components and both platform-specific path separators
- Prefer server-generated backup identifiers over user-controlled filesystem paths
- Apply separate, least-privilege authorization checks for backup download and deletion
- Restrict the application process from reading or deleting unrelated sensitive files
- Use controlled storage APIs that expose only explicitly registered backup objects
These measures reduce reliance on input formatting and limit the consequences of path validation failures.
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis rules for file APIs receiving request parameters or decoded input
- Code review checks for basename-only sanitization and missing canonical-path containment tests
- Tests covering forward slashes, backslashes, encoded separators, traversal components, and mixed path formats
- Runtime monitoring for unusual backup download or deletion requests and access to files outside approved storage
- Authorization policy reviews that verify backup permissions are narrowly assigned
Automated security review tools may help flag user-controlled paths reaching filesystem operations, but findings should be validated against deployment-specific path behavior.
