CVE-2026-50282
published 2026-07-02CVE-2026-50282: Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an…
PriorityP429medium4.9CVSS 4.0
AVNACLATNPRLUINVCNVIHVANSCNSINSANEUCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.21%
11.1th percentile
Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination. This issue has been resolved in versions 5.9.21 and 4.17.14.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| craftcms | cms | — | — |
| craftcms | cms | — | — |
| craftcms | cms | >= 4.0.0-RC1 < 4.17.14 | 4.17.14 |
| craftcms | cms | >= 5.0.0-RC1 < 5.9.21 | 5.9.21 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Craft CMS up to 4.17.14/5.9.20 actionMoveFolder authorization
vuldb·2026-07-02·CVSS 4.9
CVE-2026-50282 [MEDIUM] Craft CMS up to 4.17.14/5.9.20 actionMoveFolder authorization
A vulnerability was found in Craft CMS up to 4.17.14/5.9.20. It has been declared as critical. The impacted element is the function AssetsController::actionMoveFolder. Executing a manipulation can lead to missing authorization.
This vulnerability is handled as CVE-2026-50282. The attack can be executed remotely. There is not any exploit available.
It is recommended to upgrade the affected component.
GHSA
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
ghsa·2026-07-02
CVE-2026-50282 [HIGH] CWE-862 Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.
### Description
Craft CMS’s `craft\\controllers\\AssetsController::actionMoveFolder()` supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with `force=true` to overwrite the destination.
The permission checks for this action allow:
- `deleteAssets:` for the folder being moved
- `createFolders:` for the destination parent folder
- `saveAssets:` for the destination parent folder
The action does not require `deleteAssets` on the desti
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-02
Published