CVE-2026-50283— CraftCMS CMS 授权问题漏洞

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId. AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads: assetId -> $assetToReplace and sourceAssetId -> $sourceAsset, then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume. When both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no deletion check for for the source asset. An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId, leading to broken content references and data loss. This issue has been fixed in versions 4.17.14 and 5.9.21.

N/A

授权机制缺失

CraftCMS CMS 授权问题漏洞

CraftCMS cms是CraftCMS的内容管理系统。 CraftCMS CMS存在授权问题漏洞，该漏洞源于AssetsController::actionReplaceFile中的授权问题，通过同时提供assetId和sourceAssetId，可能导致已认证用户在没有源资产删除权限的情况下删除另一卷中的资产。以下版本受到影响：5.0.0-RC1至5.9.20版本和4.0.0-RC1至4.17.13版本。

N/A

N/A