Description

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T12:17:15.957Z",
  "pubdate": "2026-09-02T12:17:15.957Z",
  "executiveSummary": "A critical authorization vulnerability exists in Craft CMS versions prior to 5.10.11, specifically within the assets/move-asset endpoint.\nThe vulnerability originates from a failure to validate user permissions when the 'force=1' parameter is supplied during an asset move request.\nThis flaw allows authenticated users who lack appropriate peer asset permissions to move files into unauthorized directories, including those owned by other users.\nThe exploitation of this vulnerability results in unauthorized asset deletion and file replacement within the CMS, presenting a significant risk to data integrity and logical access control.\nSuccessful exploitation requires the attacker to hold an authenticated session, although elevated administrative privileges are not strictly necessary to trigger the flaw.\nThis security failure impacts the integrity of the file management system, enabling attackers to perform destructive actions against assets they are not authorized to manage or modify.\nOrganizations using affected versions of Craft CMS are exposed to potential unauthorized file system tampering and unauthorized content replacement.",
  "technicalDetails": "The vulnerability resides in the assets/move-asset endpoint of Craft CMS, which processes requests to relocate assets within the CMS directory structure.\nThe root cause is an improper authorization check when the 'force=1' flag is provided in the request parameters. While the system is designed to enforce access control lists (ACLs) for asset manipulation, the conditional logic handling the 'force' parameter inadvertently bypasses these checks.\nWhen an authenticated user invokes the move-asset operation with 'force=1', the backend fails to verify whether the requester possesses the necessary permissions to interact with or overwrite files located in the target destination directory.\nThis logic flaw enables an attacker to move their own assets into directories owned by other users, effectively bypassing user-level isolation.\nFurthermore, the 'force' mechanism facilitates the deletion of pre-existing files at the destination if a filename conflict is detected. This allows an attacker to systematically replace legitimate system assets or other users' files with their own controlled content.\nThe attack flow proceeds as follows: First, an authenticated user initiates a request to the assets/move-asset endpoint. Second, the user specifies a source path representing their controlled file and a target destination path belonging to a restricted directory. Third, the user includes the 'force=1' parameter in the request payload. Fourth, the application logic processes the request, prematurely validating the user's general authentication status while skipping the granular per-directory permission checks due to the force flag. Fifth, the backend executes the move operation, deleting any conflicting assets at the destination and completing the unauthorized relocation.\nThe impact is a complete breakdown of asset ownership and integrity, as attackers can gain write-like access to parts of the CMS file system they are explicitly restricted from. This may lead to the defacement of assets, destruction of critical data, or the potential for downstream attacks if replaced assets are served by the application to other users or administrators.\nAffected versions are strictly limited to all iterations of Craft CMS prior to the 5.10.11 release."
}