[HIGH] Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

PKSA-kbc2-vykn-d61h CVE-2026-54178 GHSA-8xjm-wqrp-2f25

Affected package: backpack/crud

Affected version: >=7.0.0,<7.0.35|>=6.0.0,<6.8.12|>=5.0.0,<6.0.0

Reported by:
GitHub