Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-32262 is a low-severity path traversal vulnerability in Craft CMS affecting versions from 4.0.0-RC1 to before 4.17.5 and 5.0.0-RC1 to before 5.9.11. The vulnerability exists in the AssetsController->replaceFile() method, where the targetFilename parameter from the request body is used without proper sanitization in a deleteFile() call before the filename is processed for saving.'}, {'type': 'paragraph', 'content': 'This allows an authenticated user with replaceFiles permission to inject "../" sequences into the filename, enabling them to delete arbitrary files within the same filesystem root. Essentially, a user with permission to replace files on one volume can delete files in other folders or volumes sharing the same filesystem root. The vulnerability only affects local filesystems.'}, {'type': 'paragraph', 'content': "The issue was fixed by adding validation to reject filenames containing directory traversal characters such as '/' or '\\', preventing this kind of attack."}] [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by exploiting path traversal sequences in filenames.

The impact is that files outside the intended directory or volume can be deleted, potentially causing data loss or disruption of service.

Since the vulnerability only affects local filesystems, remote or networked filesystems are not impacted.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves an authenticated user with replaceFiles permission exploiting the targetFilename parameter to perform directory traversal and delete arbitrary files. Detection would involve monitoring for unusual file deletion activities or suspicious requests to the AssetsController->replaceFile() endpoint containing path traversal sequences such as "../" or slashes in the targetFilename parameter.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect potential exploitation attempts include searching web server logs or application logs for requests to the replaceFile endpoint with suspicious filename parameters:'}, {'type': 'list_item', 'content': "grep -i 'replaceFile' /path/to/access.log | grep '\\.\\./'"}, {'type': 'list_item', 'content': "grep -i 'replaceFile' /path/to/access.log | grep '/'"}, {'type': 'list_item', 'content': "Review application logs for BadRequestHttpException errors indicating blocked attempts containing '/' or '\\' in targetFilename."}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The primary mitigation step is to update Craft CMS to a patched version where this vulnerability is fixed. Specifically, upgrade to version 4.17.5 or later if using the 4.x series, or version 5.9.11 or later if using the 5.x series.'}, {'type': 'paragraph', 'content': "The fix includes validation that rejects targetFilename parameters containing directory traversal characters such as '/' or '\\', preventing exploitation."}, {'type': 'paragraph', 'content': 'Additionally, review and restrict permissions to ensure only trusted authenticated users have the replaceFiles permission, minimizing the risk of exploitation.'}] [1, 2]

Useful 0 Not Useful 0