[HIGH] Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

PKSA-kbc2-vykn-d61h CVE-2026-54178 GHSA-8xjm-wqrp-2f25

Affected version: >=7.0.0,<7.0.35|>=6.0.0,<6.8.12|>=5.0.0,<6.0.0

Reported by:
GitHub

[HIGH] Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

PKSA-x88v-wcq5-j3kt CVE-2026-54175 GHSA-xpv2-hrfc-hw62

Affected version: >=7.0.0-alpha.1,<7.0.34|<6.8.11

Reported by:
GitHub