CVE-2026-84800: Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only the replaceFiles permission on a shared folder can overwrite the content of a peer's asset file (located in the same folder) with attacker-controlled bytes. Fixed in 5.10.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.11 - Compensating control
Ensure low-privilege users who only have replaceFiles permission on a shared folder cannot trigger AssetsController::actionReplaceFile in a way that omits assetId (sourceAssetId + targetFilename without assetId), since authorization may not enforce replacePeerFiles permission.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privilege author is affected if they have replaceFiles permission on a shared asset folder. The attacker must be able to target a peer asset located in that same folder.
What does an attacker need to send to bypass the peer-file permission check?
The request must provide sourceAssetId and targetFilename while omitting assetId. In that path, the target asset is resolved only after permission checks, so replacePeerFiles is not enforced.
What is the impact of successful exploitation?
The attacker can overwrite a peer's asset file in the shared folder with attacker-controlled bytes. The issue affects integrity and can also cause limited availability impact.
Which versions are affected and what version fixes the issue?
Craft CMS versions from 5.0.0-RC1 through versions earlier than 5.10.11 are affected. The issue is fixed in version 5.10.11.