Craft CMS has a Path Traversal Vulnerability in AssetsController
Published 16 Mar 2026 · Updated 16 Mar 2026
Affected packages
- Affected
- >=4.0.0-RC1 <4.17.5
- Fixed in
- 4.17.5
composer require craftcms/cms:^4.17.5- Affected
- >=5.0.0-RC1 <5.9.11
- Fixed in
- 5.9.11
composer require craftcms/cms:^5.9.11Details
The AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename.
This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root.
This only affects local filesystems.
Users should update to Craft 4.17.5 or 5.9.11 to mitigate the issue.
Is GHSA-472v-j2g4-g9h2 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.