Craft CMS up to 5.10.10 AssetsController actionReplaceFile assetId improper authorization

Summaryinfo

A vulnerability, which was classified as problematic, was found in Craft CMS up to 5.10.10. The impacted element is the function AssetsController::actionReplaceFile of the component AssetsController. The manipulation of the argument assetId results in improper authorization. This vulnerability is cataloged as CVE-2026-84800. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Craft CMS up to 5.10.10. Affected is the function AssetsController::actionReplaceFile of the component AssetsController. The manipulation of the argument assetId with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity, and availability. CVE summarizes:

Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only the replaceFiles permission on a shared folder can overwrite the content of a peer's asset file (located in the same folder) with attacker-controlled bytes. Fixed in 5.10.11.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-84800 since 09/02/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 5.10.11 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Name

• Craft CMS

Version

• 5.10.0
• 5.10.1
• 5.10.2
• 5.10.3
• 5.10.4
• 5.10.5
• 5.10.6
• 5.10.7
• 5.10.8
• 5.10.9
• 5.10.10

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion