Executive brief
Craft CMS is a web content management system used by content teams to create and manage digital assets and files. A permissions flaw in the file replacement feature allows authenticated authors with limited access rights to secretly overwrite colleague's files with arbitrary content, bypassing normal approval controls and potentially corrupting shared media assets.
Technical details
The vulnerability is a missing authorization check (CWE-862) in AssetsController::actionReplaceFile. When a replace-file request includes sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename lookup after permission validation completes, causing the replacePeerFiles permission check to be skipped. An authenticated low-privilege author with only replaceFiles permission on a shared folder can craft a request that bypasses the permission check and overwrites a peer's asset file in the same folder with attacker-controlled content. The fix was released in version 5.10.11.
Affected products
- Craft CMS CMS >= 5.0.0-RC1, < 5.10.11
Timeline
- 2026-08-18: disclosed
- 2026-09-02: advisory
- 2026-09-02: patched: Fixed in version 5.10.11