GHSA-472v-j2g4-g9h2
Craft CMS has a Path Traversal Vulnerability in AssetsController
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | craftcms/cms | >= 4.0.0-RC1, < 4.17.5 | 4.17.5 |
| Packagist | craftcms/cms | >= 5.0.0-RC1, < 5.9.11 | 5.9.11 |
Details
As written in the advisory (Markdown source, shown as plain text).
The `AssetsController->replaceFile()` method has a `targetFilename` body parameter that is used unsanitized in a `deleteFile()` call before `Assets::prepareAssetName()` is applied on save. This allows an authenticated user with `replaceFiles` permission to delete arbitrary files within the same filesystem root by injecting `../` path traversal sequences into the filename.
This could allow an authenticated user with `replaceFiles` permission on one volume to delete files in other folders/volumes that share the same filesystem root.
This only affects local filesystems.
Users should update to Craft 4.17.5 or 5.9.11 to mitigate the issue.
References
External links from the advisory. They lead to third-party sites.