Craft CMS EUVD-2026-41416

Exploitation requires a valid Craft CMS user account with asset folder move permissions (PR:L per CVSS 4.0 vector). The attack path is only reachable when a folder with the same name as the one being moved already exists at the destination parent folder - this name collision is what triggers the force=true code branch. The attacker must also lack delete permission on that conflicting destination folder; if they already hold delete rights there, no permission gap exists and the behavior is authorized. Limiting factors: no unauthenticated exploitation path exists; impact is confined to the CMS asset file system with no evidence of code execution or data exfiltration capability; exploitation requires deliberate targeting of a specific folder name conflict scenario rather than a generic scan-and-exploit pattern.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VI:H and all other impact metrics at N accurately characterizes the risk profile: the attack is network-reachable with low complexity, but is gated on authenticated access (PR:L), which is the primary limiting factor. The E:U (Unexploited) supplemental metric is consistent with the absence of a CISA KEV listing and no known public POC, indicating this is a theoretical but realistic privilege escalation within the asset subsystem rather than an immediately weaponized flaw. EPSS data was not provided in source intelligence, so exploitation probability cannot be quantified numerically. The impact is bounded to the CMS asset management layer - no server-side code execution, credential theft, or scope change is indicated (SC:N/SI:N/SA:N). This is a genuine but medium-priority finding: meaningful for organizations where multiple user roles with differentiated asset permissions are in use, but not an emergency response item given the authentication prerequisite and scoped impact.

An authenticated Craft CMS contributor account with move-asset-folder permissions but without delete permission on a specific destination folder sends a crafted POST request to the actionMoveFolder() endpoint specifying the target folder and including force=true. The application's missing authorization check allows the request to proceed, deleting the conflicting destination folder and replacing it with the moved folder - removing content the attacker was never authorized to delete. No public POC exists, but the attack surface is straightforward to identify given the advisory's disclosure of the exact controller method and parameter.