CVE-2026-104478

Executive Summary

CVE-2026-104478 is a path traversal vulnerability in Formwork (a PHP-based flat-file CMS) affecting versions before 2.3.13, specifically within the BackupController. Authenticated panel users holding backup download or delete permissions can read or delete arbitrary files on the underlying Linux host. The flaw leverages a base64-encoded, backslash-separated traversal payload that circumvents PHP's basename() sanitization, resulting in high confidentiality impact (arbitrary file read) and partial availability impact (arbitrary file deletion) with an overall CVSS score of 7.1.

Technical Analysis

The vulnerability resides in BackupController, a component responsible for handling backup operations exposed to authenticated users of the Formwork administrative panel. The controller processes user-supplied input that nominally identifies a backup filename, and it relies on PHP's basename() function as a path sanitization primitive.

The core mechanism is a sanitization bypass rooted in platform-dependent path parsing behavior. PHP's basename() is documented to be locale-aware and, on Linux builds, does not treat the backslash (\) as a directory separator — only the forward slash (/) is a separator on POSIX systems. The NVD description states the payload is "base64-encoded" and "backslash-separated." This indicates the application decodes a base64-encoded parameter and then applies basename(), expecting the function to strip traversal sequences. Because backslashes are not recognized as separators by basename() on Linux, an attacker who supplies a backslash-separated traversal sequence can retain path structure that the application's assumption about basename() fails to neutralize. The decoded value is subsequently passed into a file-handling operation (read for download, unlink for delete) without further canonicalization against the intended backup directory.

The attack surface is network-reachable (AV:N) and requires only low privileges (PR:L) — an authenticated panel account with the appropriate backup permission. No user interaction is required (UI:N). The scope remains unchanged (S:U), meaning the vulnerable component and the affected resources are under the same security authority.

Two distinct impact vectors exist based on the permission held:

• Read: arbitrary file disclosure via the backup download operation (confidentiality, C:H).
• Delete: arbitrary file removal via the backup delete operation (availability, A:L, reflecting partial impact since the flaw is scoped to files writable/deletable by the web server process user).

Specific endpoint paths, parameter names, and code line references are not present in the provided NVD description and CNA title; they are therefore not asserted here. No public PoC, Nuclei template, or exploit code has been identified, so the precise parameter name and request format cannot be confirmed from available intelligence.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-22) and the description provided.

1. Reconnaissance / target identification. An attacker identifies an internet-facing or internally reachable Formwork instance and enumerates the panel login. Because access requires authentication, the attacker must obtain valid credentials through prior compromise, credential reuse, phishing, or default/weak credential discovery. The attacker then verifies the account holds the backup download or delete permission.

2. Flaw class trigger. Within the backup management functionality, the attacker selects the download or delete action. The application accepts a filename-related argument that it base64-decodes and then sanitizes with basename(). The attacker crafts the argument so that, after base64 decoding, it contains a backslash-separated traversal sequence. On Linux, basename() does not treat \ as a directory separator, so the traversal survives sanitization and the resulting path escapes the intended backup directory.

3. Payload / execution method (class level). The attacker submits the base64-encoded, backslash-separated traversal string to the backup endpoint. The application constructs a filesystem path and performs either a file read (download response) or a file delete (unlink). No command execution is indicated by the description — the primitive is filesystem read/delete only. The attacker need not chain additional vulnerabilities for the read case.

4. Post-exploitation impact. For the read path, the attacker exfiltrates arbitrary readable files — potentially configuration files, credential stores, .env-style secrets, session data, or application source — enabling lateral movement or privilege escalation. For the delete path, the attacker removes arbitrary files writable by the web server user, which can cause denial of service, destroy backups (undermining recovery), or corrupt application state. Files outside the web-server user's ownership are not affected, bounding the delete impact.

Impact Assessment

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L yields a base score of 7.1 (High).

• Confidentiality (High): Arbitrary file read allows disclosure of any file the web server process can read, which typically includes application configuration, secrets, and source code. This is the dominant risk.
• Integrity (None): The described primitive does not permit modification of file contents — only deletion. Deletion is modeled under availability rather than integrity in this assessment.
• Availability (Low): Deletion of arbitrary files can disrupt service, but impact is bounded by filesystem permissions of the web server user, hence partial.
• Privileges Required (Low): Attack is post-authentication; unauthenticated actors cannot exploit directly. However, a low-privileged panel account with a single backup permission is sufficient.
• Attack Complexity (Low): Once the bypass technique is known, exploitation is deterministic and repeatable.

Blast radius: Every Formwork deployment below 2.3.13 with panel backup functionality enabled and reachable is affected. Because read access can expose secrets used elsewhere, the effective blast radius may extend beyond the single host to any systems or services whose credentials are stored in disclosed files. Multi-tenant hosting environments face cross-boundary risk.

Detection Guidance

Sigma Rule

title: Formwork BackupController Path Traversal Attempt (CVE-2026-104478)
id: 8f3c2a17-5b64-4d9e-9a21-7c0e5f1b9d33
status: experimental
description: Detects base64-encoded backslash-separated traversal payloads targeting Formwork backup download or delete actions.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104478
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/backup'
      - '/backups'
  selection_payload:
    cs-uri-query|contains:
      - '..%5c'
      - '..\\'
      - '%5c..%5c'
  selection_base64:
    cs-uri-query|re: '(?i)(bGkxfD|Li5c|XA==|fFwuLik)'
  condition: selection_endpoint and (selection_payload or selection_base64)
falsepositives:
  - Legitimate backup filenames containing encoded backslashes (rare)
level: high

YARA Rule

rule CVE_2026_104478_Formwork_Backup_Traversal
{
    meta:
        description = "Detects base64-encoded backslash-separated path traversal payloads for Formwork BackupController (CVE-2026-104478)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104478"
        date = "2026-01-01"

    strings:
        $b64_bs = "..\\" ascii
        $b64_bs_enc = "Li5c" ascii nocase      // base64 fragment of "..\"
        $bs_sep = "\\..\\" ascii
        $backup = "BackupController" ascii

    condition:
        (any of ($b64_bs, $b64_bs_enc, $bs_sep)) or ($backup and $b64_bs_enc)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104478 Formwork BackupController Path Traversal Attempt"; flow:established,to_server; http.uri; content:"backup"; nocase; http.uri; content:"Li5c"; nocase; reference:cve,2026-104478; classtype:attempted-user; sid:2026104478; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where network.protocol == "http" and
      url.path : ("*backup*", "*backups*") and
      url.query : ("*..\\*", "*%5c*", "*Li5c*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri, "(?i)backup")
| where match(uri, "(?i)(\.\.%5c|%5c\.\.%5c|Li5c|XA==|fFwu)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,formwork,">
  <rule id="104478" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.\.\\|%5c\.\.|Li5c</field>
    <description>CVE-2026-104478: Formwork BackupController path traversal attempt detected</description>
    <mitre>
      <id>T1005</id>
    </mitre>
    <group>cve_2026_104478,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to the Formwork administrative panel (VPN, allowlist, or reverse-proxy ACLs); this flaw requires panel authentication, so reducing reachability of the panel materially reduces exposure.
   • Review and minimize the number of accounts holding backup download/delete permissions; apply least privilege.
   • Enforce strong authentication and MFA on the panel, and rotate any credentials that may be stored in files reachable by the web server process.
   • Where feasible, run the web server process under a low-privilege system user with a tightly scoped filesystem view (containerize or chroot) to bound arbitrary file read/delete to a minimal set.
   • Monitor for anomalous backup download or delete activity (see detection rules above).

2. Patch/upgrade steps:

   • No vendor patch is confirmed by the tracked sources at this time. The NVD description states the issue is resolved in Formwork 2.3.13; upgrade to 2.3.13 or later as soon as a verified release is available from the vendor.
   • Validate the integrity and provenance of any Formwork package before deployment; verify release signatures or checksums where provided.

3. Long-term hardening:

   • Replace reliance on basename() as a security control with explicit path canonicalization (realpath()) and strict confinement of resolved paths to an allowed base directory.
   • Reject or strip both / and \ separators and encoded traversal sequences at input validation, before any filesystem call.
   • Treat filename parameters as opaque identifiers mapped to server-side records rather than raw path fragments.
   • Add regression tests for cross-platform path handling (POSIX vs. Windows separator semantics).

References

• NVD — CVE-2026-104478: https://nvd.nist.gov/vuln/detail/CVE-2026-104478
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• PHP basename() documentation (platform-dependent separator handling): https://www.php.net/manual/en/function.basename.php
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-104478 is NOT listed as of the data provided)
• FIRST EPSS: https://www.first.org/epss (CVE-2026-104478 not yet scored)

No public PoC, exploit code, Nuclei template, or threat-actor campaign has been identified in the available intelligence. Exploitation activity in the wild is not confirmed.