Executive brief
Craft CMS, a popular content management system, contains a flaw in how it handles folder deletions. A user with basic permission to manage their own folders can exploit this to delete files and folders belonging to other users on the same shared storage volume. This could lead to permanent loss of important company assets and data, as the system fails to check if the user has the specific authority to delete 'peer' content when removing a parent folder.
Technical details
A missing authorization check exists in the `AssetsController::actionDeleteFolder` endpoint of Craft CMS. While the system correctly checks for 'deletePeerAssets' permissions when deleting individual files, the folder deletion logic only verifies the 'deleteAssets' permission for the target folder itself. Because `Assets::deleteFoldersByIds()` performs a cascading delete of all descendant folders and assets without re-verifying ownership or peer-deletion rights, an authenticated attacker with folder-management rights can destroy any asset within that folder structure regardless of the uploader. This vulnerability affects versions 4.x and 5.x and has been patched in versions 4.17.15 and 5.9.22.
Affected products
- Pixel & Tonic Craft CMS >= 4.0.0-RC1, < 4.17.15
- Pixel & Tonic Craft CMS >= 5.0.0-RC1, < 5.9.22
Timeline
- 2026-05-29: disclosed
- 2026-07-01: kev added: NVD Published Date
- 2026-07-02: advisory