A high-severity path traversal vulnerability in Laravel-Backpack CRUD allows authenticated users to delete arbitrary files on the storage disk, posing a significant risk to data integrity and system availability.

This vulnerability occurs in the HasUploadFields::uploadMultipleFilesToDisk method, which fails to validate that file paths provided by the user belong to the current model record. By exploiting this flaw, an attacker with authenticated update access can perform unauthorized file deletions on the configured storage disk.

The ability for an authenticated user to delete arbitrary operational files or shared assets can lead to severe service disruption and permanent data loss. Given the CVSS score of 8.1, this vulnerability is classified as high severity, as it directly impacts system availability and integrity, potentially requiring extensive recovery efforts to restore deleted assets.

Immediate Action: Update the Laravel-Backpack CRUD package to version 6.8.12 or 7.0.35 immediately to incorporate the necessary validation logic.

Proactive Monitoring: Monitor application logs for unexpected file deletion requests or unusual patterns of activity associated with the CRUD update endpoints.

Compensating Controls: Implement strict file system permissions that limit the web server's ability to delete files outside of designated upload directories, effectively reducing the scope of potential damage.

Public Exploit Available: Unknown

This vulnerability represents a critical integrity risk to administrative panels managed by Laravel-Backpack. Organizations should prioritize updating to the patched versions as soon as possible, as the flaw is easily reachable by any user possessing standard administrative update privileges. Failure to patch may expose the underlying file system to malicious modification by compromised or malicious user accounts.