GHSA-472v-j2g4-g9h2Medium
Craft CMS has a Path Traversal Vulnerability in AssetsController
🔗 CVE IDs covered (1)
📋 Description
The AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename.
This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root.
This only affects local filesystems.
Users should update to Craft 4.17.5 or 5.9.11 to mitigate the issue.
🎯 Affected products2
- composer/craftcms/cms:>= 4.0.0-RC1, <= 4.17.4
- composer/craftcms/cms:>= 5.0.0-RC1, <= 5.9.10