CVE-2026-32262

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename. This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root. This only affects local filesystems. This issue has been patched in versions 4.17.5 and 5.9.11.

• CWE-22

• https://github.com/craftcms/cms/commit/c997efbe4c66c14092714233aeebff15cdbfcf11Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-472v-j2g4-g9h2Patch, Vendor Advisory

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32257Winter is a free, open-source content management system (CMS…8.1
• CVE-2026-32258Winter is a free, open-source content management system (CMS…8.1
• CVE-2026-32259ImageMagick is free and open-source software used for editin…6.7
• CVE-2026-3226The LearnPress – WordPress LMS Plugin plugin for WordPress i…4.3
• CVE-2026-32260Deno is a JavaScript, TypeScript, and WebAssembly runtime. F…9.8
• CVE-2026-32261Webhooks for Craft CMS plugin adds the ability to manage “we…8.5
• CVE-2026-32263Craft CMS is a content management system (CMS). From version…7.2
• CVE-2026-32264Craft CMS is a content management system (CMS). From version…7.2
• CVE-2026-32265The Amazon S3 for Craft CMS plugin provides an Amazon S3 int…6.9
• CVE-2026-32266The Google Cloud Storage for Craft CMS plugin provides a Goo…2.4
• CVE-2026-32267Craft CMS is a content management system (CMS). From version…9.8
• CVE-2026-32268The Azure Blob Storage for Craft CMS plugin provides an Azur…8.7