https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 21:24:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276370 EUVD-2026-276370 https://cve.radiocsirt.org/vuln/euvd-2026-276370 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32262 <p>Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController-&gt;replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename. This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root. This only affects local filesystems. This issue has been patched in versions 4.17.5 and 5.9.11.</p> <p>Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController-&gt;replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename. This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root. This only affects local filesystems. This issue has been patched in versions 4.17.5 and 5.9.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32262 https://cve.radiocsirt.org/vuln/ghsa-472v-j2g4-g9h2 <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>The `AssetsController-&gt;replaceFile()` method has a `targetFilename` body parameter that is used unsanitized in a `deleteFile()` call before `Assets::prepareAssetName()` is applied on save. This allows an authenticated user with `replaceFiles` permission to delete arbitrary files within the same filesystem root by injecting `../` path traversal sequences into the filename.</p> <p>This could allow an authenticated user with `replaceFiles` permission on one volume to delete files in other folders/volumes that share the same filesystem root.</p> <p>This only affects local filesystems.</p> <p>Users should update to Craft 4.17.5 or 5.9.11 to mitigate the issue.</p> <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>The `AssetsController-&gt;replaceFile()` method has a `targetFilename` body parameter that is used unsanitized in a `deleteFile()` call before `Assets::prepareAssetName()` is applied on save. This allows an authenticated user with `replaceFiles` permission to delete arbitrary files within the same filesystem root by injecting `../` path traversal sequences into the filename.</p> <p>This could allow an authenticated user with `replaceFiles` permission on one volume to delete files in other folders/volumes that share the same filesystem root.</p> <p>This only affects local filesystems.</p> <p>Users should update to Craft 4.17.5 or 5.9.11 to mitigate the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-472v-j2g4-g9h2