PT-2026-55412 · Packagist · Craftcms/Cms
Publicado
2026-07-02
·
Atualizado
2026-07-02
CVSS v4.0
5.3
Média
| Vetor | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N |
We have identified an authorization issue in Craft CMS
AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.Description
Craft CMS’s
craftcontrollersAssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads:$assetToReplacefromassetId$sourceAssetfromsourceAssetId
It then enforces replace permissions using
($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume.php
$this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace ?: $sourceAsset);
$this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace ?: $sourceAsset);In the branch where both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no check for
deleteAssets:<sourceVolumeUid> or deletePeerAssets:<sourceVolumeUid> for the source asset before deletion.php
$assets->replaceAssetFile($assetToReplace, $tempPath, $assetToReplace->getFilename(), $sourceAsset->getMimeType());
Craft::$app->getElements()->deleteElement($sourceAsset);Impact
An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a
sourceAssetId. This can lead to unauthorized asset deletion, broken content references, and data loss.Correção
IDOR
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Craftcms/Cms