CVE-2026-50283
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
Description
Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId. AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads: assetId -> $assetToReplace and sourceAssetId -> $sourceAsset, then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume. When both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no deletion check for for the source asset. An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId, leading to broken content references and data loss. This issue has been fixed in versions 4.17.14 and 5.9.21.
INFO
Published Date :
July 1, 2026, 11:16 p.m.
Last Modified :
Oct. 25, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update Craft CMS to version 4.17.14 or later.
- Update Craft CMS to version 5.9.21 or later.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-50283.
| URL | Resource |
|---|---|
| https://github.com/craftcms/cms/commit/2c2579c7f1030872423f268d0c8b48377101961d | |
| https://github.com/craftcms/cms/security/advisories/GHSA-qh45-9g5p-m2v4 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-50283 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-50283
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-50283 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-50283 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: cms de craftcms, Description: Craft CMS es un sistema de gestión de contenido (CMS). Las versiones 5.0.0-RC1 hasta 5.9.20, y 4.0.0-RC1 hasta 4.17.13 contienen un problema de autorización en AssetsController::actionReplaceFile que puede eliminar un activo de origen sin permiso de eliminación de origen al proporcionar tanto assetId como sourceAssetId. AssetsController::actionReplaceFile() admite reemplazar un archivo de activo de destino utilizando otro activo existente como origen. La acción carga: assetId -> $assetToReplace y sourceAssetId -> $sourceAsset, luego aplica los permisos de reemplazo utilizando ($assetToReplace ?: $sourceAsset). Cuando se proporcionan ambos ID, esta expresión se resuelve en el activo de destino, por lo que no se realiza ninguna verificación de permiso contra el volumen del activo de origen. Cuando ambos activos están presentes, Craft copia el archivo de origen en el destino y luego elimina el activo de origen. No hay verificación de eliminación para el activo de origen. Un usuario autenticado que puede reemplazar archivos en un volumen puede eliminar activos en otro volumen donde no tiene permiso de eliminación, siempre que pueda obtener un sourceAssetId, lo que lleva a referencias de contenido rotas y pérdida de datos. Este problema ha sido solucionado en las versiones 4.17.14 y 5.9.21. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 02, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-50283', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-02T14:46:55.781150Z'} -
New CVE Received by [email protected]
Jul. 01, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'craftcms', 'product': 'cms', 'versions': [{'status': 'affected', 'version': '>= 5.0.0-RC1, < 5.9.21'}, {'status': 'affected', 'version': '>= 4.0.0-RC1, < 4.17.14'}]}] Added Description Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId. AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads: assetId -> $assetToReplace and sourceAssetId -> $sourceAsset, then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume. When both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no deletion check for for the source asset. An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId, leading to broken content references and data loss. This issue has been fixed in versions 4.17.14 and 5.9.21. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-639 Added CWE CWE-862 Added Reference https://github.com/craftcms/cms/commit/2c2579c7f1030872423f268d0c8b48377101961d Added Reference https://github.com/craftcms/cms/security/advisories/GHSA-qh45-9g5p-m2v4