CVE-2026-32262: 
PHP vulnerability analysis and mitigation

CVE-2026-32262 is a path traversal vulnerability in the AssetsController->replaceFile() method of Craft CMS, classified as Moderate severity. It affects Craft CMS versions 4.0.0-RC1 through 4.17.4 and 5.0.0-RC1 through 5.9.10 on local filesystem deployments. The vulnerability was published on March 16, 2026, by the Craft CMS security team via GitHub Advisory GHSA-472v-j2g4-g9h2. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Craft CMS Advisory).

The root cause is improper input validation (CWE-22 — Path Traversal) in the AssetsController->replaceFile() method, where the targetFilename body parameter is passed unsanitized to a deleteFile() call before Assets::prepareAssetName() sanitization is applied. An authenticated attacker with replaceFiles permission can inject ../ sequences into the targetFilename parameter to traverse outside the intended directory and delete arbitrary files within the same filesystem root. The fix, applied in commit c997efb, adds a check that throws a BadRequestHttpException if the targetFilename contains / or \ characters, preventing path traversal. This vulnerability is limited to local filesystem volumes and does not affect remote or cloud-based storage (Craft CMS Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker with replaceFiles permission on one volume to delete arbitrary files in other folders or volumes that share the same local filesystem root. This can result in data loss, deletion of critical application or configuration files, and potential system instability. There is no confidentiality or integrity impact on data content — the vulnerability is limited to unauthorized file deletion (availability impact). Lateral movement across volumes is possible if multiple volumes share the same filesystem root (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.037% (12th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid authentication credentials and the replaceFiles permission, which limits the attacker pool to trusted or compromised internal users.

1. Reconnaissance: Identify a Craft CMS instance running a vulnerable version (4.0.0-RC1–4.17.4 or 5.0.0-RC1–5.9.10) with local filesystem volumes configured.
2. Obtain credentials: Acquire or compromise an account with replaceFiles permission on at least one asset volume.
3. Identify target file: Determine the relative path from the attacker-accessible volume to a target file in another folder or volume sharing the same filesystem root (e.g., a configuration file or application asset).
4. Craft malicious request: Send an authenticated HTTP POST request to the replaceFile action endpoint, setting the targetFilename body parameter to a path traversal payload such as ../../other-volume/important-file.php.
5. Trigger file deletion: The unsanitized targetFilename is passed to deleteFile() before sanitization, causing the server to delete the targeted file outside the permitted directory.
6. Achieve objective: The target file is deleted, potentially causing application errors, data loss, or disruption of service depending on the criticality of the deleted file (Craft CMS Advisory, Patch Commit).

• Network: Authenticated HTTP POST requests to the Craft CMS replaceFile action endpoint containing targetFilename values with ../ or ..\ sequences in the request body.
• Logs: Craft CMS application logs showing file deletion events for files outside the expected asset volume directory; unexpected BadRequestHttpException errors on patched systems indicating attempted exploitation.
• File System: Missing files in asset directories or adjacent directories that were not intentionally deleted; unexpected gaps in asset volume contents, particularly configuration or PHP files.
• Process: Unexpected file system changes (deletions) in directories outside configured asset volumes, detectable via file integrity monitoring tools (Craft CMS Advisory).

Update Craft CMS to version 4.17.5 (for the 4.x branch) or 5.9.11 (for the 5.x branch), which include the fix that validates the targetFilename parameter to reject any value containing / or \ characters. As an interim measure, restrict replaceFiles permissions to only trusted users who genuinely require this functionality, and implement filesystem-level access controls to limit the blast radius of any path traversal. Consider monitoring file deletion activity on local filesystem volumes as an additional detection layer (Craft CMS Advisory, Patch Commit).