CVE-2026-84800 Overview
CVE-2026-84800 is a missing authorization vulnerability [CWE-862] in Craft CMS affecting versions >= 5.0.0-RC1 and < 5.10.11. The flaw resides in AssetsController::actionReplaceFile, where the replacePeerFiles permission check is skipped when the request omits assetId and instead supplies sourceAssetId and targetFilename. An authenticated low-privilege author who holds only the replaceFiles permission on a shared folder can overwrite a peer's asset file with attacker-controlled bytes. The issue is fixed in Craft CMS 5.10.11.
Critical Impact
Authenticated authors can overwrite peer-owned asset files in shared folders, replacing legitimate content with attacker-supplied bytes and undermining content integrity.
Affected Products
- Craft CMS >= 5.0.0-RC1
- Craft CMS < 5.10.11
- Fixed in Craft CMS 5.10.11
Discovery Timeline
- 2026-09-02 - CVE-2026-84800 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84800
Vulnerability Analysis
The vulnerability lives in the actionReplaceFile handler of the Craft CMS AssetsController. The controller supports two request shapes for replacing an asset. When the client supplies assetId, the target is resolved up front and the associated permission checks include replacePeerFiles for cross-user replacements. When the client omits assetId and instead supplies sourceAssetId together with targetFilename, the target asset is resolved by folder and filename after the permission checks have already run. As a result, the replacePeerFiles permission is never enforced for this code path.
An attacker who is authenticated as a low-privilege author only needs the replaceFiles permission on a folder shared with other users. The account does not require administrative rights or ownership of the target file. The impact is scoped to file content integrity, since the vulnerability enables overwriting existing peer assets rather than executing code or exfiltrating data.
Root Cause
The root cause is an ordering defect in the authorization logic. Permission validation occurs before the target asset is resolved on the alternate request path. Because replacePeerFiles is contingent on the identity of the target asset's owner, skipping resolution before authorization allows peer files to bypass the ownership gate.
Attack Vector
The attack requires network access to the Craft CMS control panel or asset upload endpoint and authenticated session credentials for an account with replaceFiles on a shared folder. The attacker issues a file replacement request containing sourceAssetId (an asset they own or can upload) and targetFilename matching a peer's asset in the same folder, while deliberately omitting assetId. The server resolves the target by folder plus filename and overwrites the peer's file bytes with the attacker-controlled payload.
No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-329j-cx85-8r56 and the VulnCheck Craft CMS Advisory for technical details.
Detection Methods for CVE-2026-84800
Indicators of Compromise
- Unexpected modifications to asset files in shared folders where the modifying user is not the original uploader.
- HTTP POST requests to the assets replace-file endpoint that include sourceAssetId and targetFilename parameters without an accompanying assetId.
- Asset content hashes that change without a corresponding entry in the Craft CMS audit log for the file's owner.
Detection Strategies
- Inspect Craft CMS web server logs for actionReplaceFile requests where the request body lacks assetId but supplies both sourceAssetId and targetFilename.
- Compare asset file hashes against known-good baselines and flag files modified by user accounts that do not own the asset.
- Correlate authenticated author sessions with file mutation events in shared folders to surface cross-user overwrites.
Monitoring Recommendations
- Enable verbose logging on the Craft CMS assets endpoints and forward logs to a centralized SIEM for retention and query.
- Alert on any file replacement activity performed by non-admin accounts against peer-owned assets.
- Track version drift across environments to confirm the patched release 5.10.11 is deployed everywhere.
How to Mitigate CVE-2026-84800
Immediate Actions Required
- Upgrade all Craft CMS instances to version 5.10.11 or later without delay.
- Audit the replaceFiles permission across user groups and remove it from accounts that do not require it.
- Review recent modifications to assets in shared folders and restore any peer files that were overwritten without authorization.
Patch Information
Craft CMS 5.10.11 corrects the ordering defect by resolving the target asset before executing the replacePeerFiles permission check on the sourceAssetId and targetFilename code path. See the GitHub Security Advisory GHSA-329j-cx85-8r56 for the fix commit and release notes.
Workarounds
- Restrict replaceFiles permissions so that authors do not share write access to folders containing peer-owned assets.
- Segment asset folders per user or per role to eliminate the shared-folder precondition required by this vulnerability.
- Enforce backups and version history on the asset volume so overwritten files can be recovered pending the upgrade.
# Upgrade Craft CMS to the patched release using Composer
composer require craftcms/cms:^5.10.11 --update-with-dependencies
php craft up
php craft clear-caches/all
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
