Craft CMS EUVD-2026-41154

Exploitation requires an authenticated Craft CMS user account with 'Replace files' permission granted in at least one asset volume. The attacker must additionally obtain a valid numeric asset ID (sourceAssetId) for an asset residing in a different volume where they lack delete permission; Craft CMS assigns sequential integer IDs to assets, and the CMS media browser UI may expose IDs from multiple volumes to any authenticated user. The vulnerability is triggered exclusively by the AssetsController::actionReplaceFile HTTP endpoint when both the assetId and sourceAssetId request parameters are supplied in the same request - standard single-parameter replace operations are unaffected. Exploitation is bounded by: mandatory low-privilege CMS authentication, possession of 'Replace files' permission in at least one volume, and the ability to discover or enumerate a valid sourceAssetId in the victim volume. Unauthenticated external attackers cannot exploit this flaw.

The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N accurately characterizes a medium-severity issue: network-accessible with low complexity, but gated behind authenticated low-privilege access and limited in scope to partial integrity and availability impact. The real-world risk is substantially shaped by deployment context - in a single-editor installation the impact is negligible, but in multi-tenant or agency environments with granular volume permissions (the typical Craft CMS use case), a malicious or compromised editor could silently destroy assets in restricted volumes, breaking site content and triggering data-loss incidents. The lack of CISA KEV listing and absence of identified public POC code reduce the probability of opportunistic exploitation from external threat actors. EPSS data was not provided; given the PR:L requirement, widespread automated scanning is unlikely. The primary risk vector is insider threat or account compromise within an authenticated CMS user pool. The CVSS vector and description are fully consistent - no conflicting signals detected.

An authenticated Craft CMS editor with 'Replace files' permission in Volume A (e.g., a public uploads volume) but no delete permission in Volume B (e.g., a protected documents archive) opens the media browser to enumerate a valid asset ID in Volume B. The editor then crafts a POST request to the actionReplaceFile endpoint supplying their own asset's ID as assetId and the Volume B asset's ID as sourceAssetId. The server's ternary permission check resolves to the Volume A target, grants the operation, copies the source file into the target, and then unconditionally deletes the Volume B asset - leaving broken content references site-wide and no audit trail of the delete action. No public exploit code has been identified, but the attack requires only standard HTTP tooling and knowledge of a valid sourceAssetId.