CVE-2026-32262 Details
Description
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename. This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root. This only affects local filesystems. This issue has been patched in versions 4.17.5 and 5.9.11.
A path traversal vulnerability has been identified in Craft CMS versions 4.0.0-RC1 prior to 4.17.5 and 5.0.0-RC1 prior to 5.9.11. The issue arises in the AssetsController's replaceFile() method, where the targetFilename parameter is used in a deleteFile() call without proper sanitization. This vulnerability allows authenticated users with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename. Exploitation could enable deletion of files in different folders or volumes that share the same filesystem root, but only on local filesystems.
Users are advised to update Craft CMS to version 4.17.5 or 5.9.11.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| craftcms craft cms | >= 4.0.0.1, < 4.17.5 >= 5.0.1, < 5.9.11 4.0.0 - 4.0.0 rc1 4.0.0 rc2 4.0.0 rc3 5.0.0 - 5.0.0 rc1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Mar 16, 2026 | New CVE Received | [email protected] |