https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T00:01:06.333498+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-332401 EUVD-2026-332401 2026-10-18T00:01:06.380485+00:00 EUVD-2026-332401 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50282 fkie_cve-2026-50282 2026-10-18T00:01:06.380523+00:00

Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination. This issue has been resolved in versions 5.9.21 and 4.17.14.

 https://cve.radiocsirt.org/vuln/ghsa-3w32-23wj-rxg3 GHSA-3w32-23wj-rxg3 — Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves 2026-10-18T00:01:06.380559+00:00

Affected: Packagist: craftcms/cms

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.

### Description

Craft CMS’s `craft\\controllers\\AssetsController::actionMoveFolder()` supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with `force=true` to overwrite the destination.

The permission checks for this action allow:

- `deleteAssets:<sourceVolumeUid>` for the folder being moved - `createFolders:<destVolumeUid>` for the destination parent folder - `saveAssets:<destVolumeUid>` for the destination parent folder

The action does not require `deleteAssets` on the destination volume or destination conflict folder. When `force=true` and a name conflict exists, the code deletes the destination folder to resolve the conflict.

```php $this->requireVolumePermissionByFolder('deleteAssets', $folderToMove); $this->requireVolumePermissionByFolder('createFolders', $destinationFolder); $this->requireVolumePermissionByFolder('saveAssets', $destinationFolder); ```

[*src/controllers/AssetsController.php:L751-L753*](https://github.com/craftcms/cms/blob/5.x/src/controllers/AssetsController.php#L751-L753)

Indexed destination conflicts are deleted via the Assets service:

```php $assets->deleteFoldersByIds($existingFolder->id); ```

[*src/controllers/AssetsController.php:L798-L798*](https://github.com/craftc…