Craft CMS EUVD-2026-69906

Exploitation requires a valid authenticated session with any low-privilege Craft CMS account (PR:L) - no administrator or elevated role is needed. The attacker must supply the force=1 parameter in the move-asset request and know or enumerate a valid target folder ID. No non-default configuration is required; the flaw exists in the default asset-management controller. Exploitation is limited to the integrity and availability of assets (files) within the CMS - no server-side code execution or credential disclosure is implied. Attackers without any authenticated account cannot exploit this remotely.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) reflects a low-barrier, network-exploitable flaw requiring only a valid authenticated session with no special configuration prerequisites, yielding a 7.1 score weighted toward high integrity impact (VI:H) with low availability impact (VA:L) and no confidentiality exposure (VC:N). EPSS data is not included in this record, and the CVE has not been added to the CISA KEV catalog, so no confirmed active exploitation signal exists. The lack of public POC keeps real-world risk somewhat bounded, but even a mid-sized municipal IT team in leszno running Craft CMS for public-facing content management should treat this as an urgent patch given the trivially low attack complexity for any internal or guest-level account holder. The primary concern is integrity: authenticated users with minimal privileges can overwrite or erase files belonging to higher-privilege editors or administrators, potentially enabling content tampering or indirect privilege abuse via file replacement.

An authenticated low-privilege content editor crafts a POST request to the assets/move-asset endpoint, supplying force=1 and the ID of a target folder owned by a more privileged user or another author. The server processes the move without verifying the requester's permissions on the destination, deletes any conflicting file already in that folder, and places the attacker's asset there. No exploit code is publicly known, but the attack requires only standard HTTP tooling and a valid session token.