CVE-2026-50282: 
PHP vulnerability analysis and mitigation

CVE-2026-50282 is an authorization bypass vulnerability in Craft CMS titled "Unauthorized Deletion of Destination Folders During Forced Moves." It affects Craft CMS versions 5.0.0-RC1 through 5.9.20 (5.x branch) and 4.0.0-RC1 through 4.17.13 (4.x branch). The vulnerability was first published by the Craft CMS security team on May 29, 2026, and added to the NVD on July 2, 2026. It carries a CVSS v4.0 base score of 4.9 (Medium) per Feedly/NVD, though the GitHub Advisory Database rates it as High (7.1) (GitHub Advisory, Craft CMS Advisory).

The root cause is a missing authorization check (CWE-862) in craft\controllers\AssetsController::actionMoveFolder(). When moving an asset folder to a destination where a folder with the same name already exists, the action can be invoked with force=true to overwrite the conflicting destination. The permission checks only verify deleteAssets on the folder being moved, and createFolders/saveAssets on the destination parent — but critically do not require deleteAssets permission on the destination volume or the conflicting folder itself. When a name conflict is detected and force=true is set, the code deletes the destination folder either via $assets->deleteFoldersByIds($existingFolder->id) (for indexed folders) or $targetVolume->deleteDirectory(...) (for unindexed folders), bypassing the expected authorization boundary (Craft CMS Advisory, GitHub Advisory).

An authenticated user with folder move permissions but without delete permissions on a destination volume can exploit this vulnerability to permanently delete asset folders and their contents they are not authorized to remove. This can result in asset loss, broken references in entries and fields pointing to deleted assets, and operational disruption to the CMS. There is no confidentiality impact, but the integrity impact is rated High due to unauthorized data destruction (GitHub Advisory, Craft CMS Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires authenticated access with at minimum folder move permissions, making unauthenticated exploitation impossible. The EPSS score is approximately 0.207% (11th percentile), indicating a low probability of exploitation in the near term. The CVE status is listed as "Deferred" and the NVD SSVC assessment confirms no known exploitation (Feedly). It is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Authenticate: Log in to a Craft CMS instance as a user with deleteAssets permission on a source volume and createFolders/saveAssets permissions on a destination volume, but without deleteAssets permission on the destination volume.
2. Identify target folder: Locate or create an asset folder in the destination volume whose name matches a folder the attacker controls in the source volume.
3. Initiate forced move: Send a crafted POST request to the actionMoveFolder() endpoint (e.g., via the Craft CMS control panel or direct API call) specifying the source folder ID, the destination parent folder ID, and the parameter force=true.
4. Trigger unauthorized deletion: Because the permission check only validates delete rights on the source folder — not the destination — the CMS proceeds to delete the conflicting destination folder (and all its contents) to resolve the naming conflict, either via deleteFoldersByIds() or deleteDirectory().
5. Observe impact: The destination folder and its assets are permanently deleted, breaking any content references pointing to those assets (Craft CMS Advisory, GitHub Advisory).

• Logs: Craft CMS application logs showing actionMoveFolder() calls with force=true parameters, particularly where the acting user lacks deleteAssets permission on the destination volume; unexpected folder deletion events in the CMS audit log.
• File System: Sudden disappearance of asset directories on the volume filesystem; missing files that were previously referenced in CMS entries or fields.
• Application Behavior: Broken asset references or missing images/files in CMS content that previously existed; entries or fields returning 404s for previously valid asset URLs.

Craft CMS has released patched versions addressing this vulnerability: 5.9.21 for the 5.x branch and 4.17.14 for the 4.x branch. Users should upgrade to these versions immediately. As a temporary workaround prior to patching, administrators should restrict folder move permissions to trusted users only, and audit existing asset folder permissions to identify any unauthorized deletions that may have already occurred. The fix is referenced in commit 2c2579c (Craft CMS Advisory, GitHub Advisory).

The vulnerability was reported by security researchers davidbors-snyk and cataliniovita-snyk, suggesting it was discovered through a Snyk security audit of the Craft CMS codebase (Craft CMS Advisory). No significant broader media coverage or notable community commentary beyond the standard advisory publication has been observed at this time.