PT-2026-55412 · Packagist · Craftcms/Cms
Published
2026-07-02
·
Updated
2026-07-02
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N |
We have identified an authorization issue in Craft CMS
AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.Description
Craft CMS’s
craftcontrollersAssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads:$assetToReplacefromassetId$sourceAssetfromsourceAssetId
It then enforces replace permissions using
($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume.php
$this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace ?: $sourceAsset);
$this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace ?: $sourceAsset);In the branch where both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no check for
deleteAssets:<sourceVolumeUid> or deletePeerAssets:<sourceVolumeUid> for the source asset before deletion.php
$assets->replaceAssetFile($assetToReplace, $tempPath, $assetToReplace->getFilename(), $sourceAsset->getMimeType());
Craft::$app->getElements()->deleteElement($sourceAsset);Impact
An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a
sourceAssetId. This can lead to unauthorized asset deletion, broken content references, and data loss.Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Craftcms/Cms