CVE-2026-84800

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.10

Description An authorization flaw exists in the AssetsController::actionReplaceFile() function. When a request provides the sourceAssetId and targetFilename variables but omits the assetId variable, the system resolves the target asset by folder and filename after permission checks have already occurred. This sequence prevents the replacePeerFiles permission from being enforced. Consequently, an authenticated low-privilege author who possesses only the replaceFiles permission on a shared folder can overwrite the content of another user's asset file within the same folder using attacker-controlled data.

Recommendations Update Craft CMS to version 5.10.11.