CVE-2026-32262: Craft CMS has a Path Traversal Vulnerability in AssetsController
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename. This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root. This only affects local filesystems. This issue has been patched in versions 4.17.5 and 5.9.11.
Other sources
The AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename.
This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root.
This only affects local filesystems.
Users should update to Craft 4.17.5 or 5.9.11 to mitigate the issue.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32262?
CVE-2026-32262 is considered a high severity vulnerability due to its potential for path traversal exploits.
How do I fix CVE-2026-32262?
To fix CVE-2026-32262, update Craft CMS to version 4.17.5 or 5.9.11 or later.
What versions of Craft CMS are affected by CVE-2026-32262?
Craft CMS versions from 4.0.0-RC1 to before 4.17.5 and from 5.0.0-RC1 to before 5.9.11 are affected by CVE-2026-32262.
What component is vulnerable in CVE-2026-32262?
The vulnerable component in CVE-2026-32262 is the AssetsController, specifically the replaceFile() method.
Is CVE-2026-32262 a known exploitation risk?
Yes, CVE-2026-32262 poses a risk as attackers can exploit the path traversal vulnerability to access unauthorized files.