Executive brief
Craft CMS, a popular content management system, contains a flaw in how it handles asset folder management. An authorized user who has permission to move folders but lacks permission to delete them can bypass security restrictions to delete folders and their contents in other areas of the system. This could lead to permanent loss of business assets, broken website links, and operational disruption.
Technical details
A missing authorization check exists in Craft CMS's `AssetsController::actionMoveFolder()`. When a folder move is initiated with the `force=true` parameter, the application fails to verify if the user has `deleteAssets` permissions for the destination volume or the specific conflicting folder. An attacker with low-level privileges (specifically `deleteAssets` on the source and `createFolders`/`saveAssets` on the destination) can overwrite and effectively delete any existing folder at the destination by triggering a name conflict. This affects both indexed folders via the Assets service and unindexed folders directly on the filesystem. The issue is patched in versions 4.17.14 and 5.9.21.
Affected products
- Pixel & Tonic Craft CMS >= 4.0.0-RC1, < 4.17.14; >= 5.0.0-RC1, < 5.9.21
Timeline
- 2026-05-29: disclosed: Initial disclosure to vendor
- 2026-07-02: advisory: GitHub Advisory published
- 2026-07-02: patched: Fixes released in versions 4.17.14 and 5.9.21
References
- https://api.github.com/users/davidbors-snyk
- https://github.com/davidbors-snyk
- https://api.github.com/users/davidbors-snyk/gists%7B/gist_id%7D
- https://api.github.com/users/davidbors-snyk/repos
- https://avatars.githubusercontent.com/u/240482518?v=4
- https://api.github.com/users/davidbors-snyk/events%7B/privacy%7D