CVE-2026-32262 in Craft
Summary
by MITRE • 03/16/2026
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename. This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root. This only affects local filesystems. This issue has been patched in versions 4.17.5 and 5.9.11.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/21/2026
This vulnerability exists in Craft CMS versions between 4.0.0-RC1 and 4.17.4, as well as 5.0.0-RC1 and 5.9.10, specifically within the AssetsController->replaceFile() method. The flaw stems from improper input validation and sanitization of the targetFilename parameter, which is directly used in a deleteFile() operation without adequate path validation. The vulnerability is classified as a path traversal attack pattern that aligns with CWE-22, which describes improper limitation of a pathname to a restricted directory. The issue occurs because the system allows unfiltered user input to construct file paths that can traverse directories using ../ sequences, bypassing normal access controls.
The technical implementation of this vulnerability involves an authenticated user with replaceFiles permission executing a malicious file replacement operation. When the replaceFile() method processes the targetFilename parameter, it immediately passes this unsanitized input to deleteFile() before applying the Assets::prepareAssetName() sanitization function during the save operation. This sequence creates a window where malicious path traversal sequences can be injected into the filename parameter. The exploitation requires the attacker to have legitimate access to the CMS with appropriate permissions, but the vulnerability enables them to perform unauthorized file deletions across the filesystem root. The attack vector is particularly dangerous because it can potentially allow deletion of files in other volumes or directories that share the same filesystem root, expanding the scope of the impact beyond the intended asset management boundaries.
The operational impact of this vulnerability is significant for organizations relying on Craft CMS for content management. An authenticated attacker with replaceFiles permissions can potentially delete critical system files, configuration files, or user data from the filesystem. This represents a privilege escalation scenario where a user with limited file replacement capabilities gains the ability to perform arbitrary file deletions. The vulnerability affects only local filesystems, which means it does not impact cloud storage solutions or remote file systems directly, but it can still cause substantial damage within the confines of a single server environment. The issue particularly affects multi-volume setups where different volumes might share the same filesystem root, creating a broader attack surface than initially apparent. This vulnerability directly relates to ATT&CK technique T1059.001 for command and scripting interpreter and T1485 for data destruction, as it enables unauthorized file deletion operations that could compromise system integrity and availability.
The remediation for this vulnerability involves upgrading to Craft CMS versions 4.17.5 or 5.9.11, which implement proper input sanitization and path validation in the AssetsController->replaceFile() method. The patched versions ensure that the targetFilename parameter is properly sanitized before any filesystem operations occur, preventing path traversal sequences from being executed. Organizations should also implement additional security measures including principle of least privilege access controls, regular security audits of file system permissions, and monitoring for unusual file deletion patterns. The fix aligns with security best practices for input validation and secure coding standards, specifically addressing the CWE-22 path traversal vulnerability by ensuring proper path sanitization before filesystem operations. System administrators should conduct thorough testing of the upgrade process to ensure that existing functionality remains intact while addressing the security gap. The vulnerability highlights the importance of proper input validation in web applications and the critical need for sanitizing user-supplied data before using it in filesystem operations.