Path traversal in Craft CMS - CVE-2026-32262
Published: June 16, 2026
Vulnerability identifier: #VU134663
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-32262
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to delete arbitrary files within the same filesystem root.
The vulnerability exists due to path traversal in AssetsController->replaceFile() when processing the targetFilename body parameter. A remote user can inject ../ sequences into the filename to delete arbitrary files within the same filesystem root.
This only affects local filesystems and can impact other folders or volumes that share the same filesystem root.
Affected software
Craft CMS
How to mitigate CVE-2026-32262
Install security update from vendor's website.
Craft CMS - addressed in versions 4.17.5, 5.9.11