Vulnerability Description
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only the replaceFiles permission on a shared folder can overwrite the content of a peer's asset file (located in the same folder) with attacker-controlled bytes. Fixed in 5.10.11.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/craftcms/cms/security/advisories/GHSA-329j-cx85-8r56
- https://www.vulncheck.com/advisories/craft-cms-5.0.0-rc1-before-5.10.11-file-ove
FAQ
What is CVE-2026-84800?
CVE-2026-84800 is a vulnerability with a CVSS score of 7.1 (HIGH). Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits a...
How severe is CVE-2026-84800?
CVE-2026-84800 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-84800?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.