The vulnerability exists in the HasUploadFields::uploadMultipleFilesToDisk method of Laravel-Backpack CRUD, which improperly trusts disk-relative paths from clear_<attribute>[] inputs and passes them to Storage::disk()->delete without verifying that these paths belong to the current model record. This allows an authenticated user with Update permissions to delete files outside their authorized scope by specifying arbitrary paths. The newer MultipleFiles uploader mitigates this by intersecting requested deletions with the record's persisted file list. The flaw affects versions prior to 6.8.12 and 7.0.35, including all 5.x releases.

An authenticated user with Update access can delete files on the storage disk that they should not be authorized to delete, including attachments of other records or shared assets. This can cause denial of availability of important files. The vulnerability does not permit reading or accessing the contents of deleted files. The CVSS 3.1 score is 8.1 (high severity) reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact.

This vulnerability is fixed in Laravel-Backpack CRUD versions 6.8.12 and 7.0.35. Users should upgrade to these or later versions to remediate the issue. The vendor advisory confirms the fix; no additional mitigation steps are required beyond applying the official patch.