CVE-2026-84800

Craft CMS 5.x (versions 5.0.0-RC1 through before 5.10.11) fails to enforce the replacePeerFiles permission in AssetsController::actionReplaceFile (CWE-862, missing authorization). When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the permission required to overwrite another user's asset is never enforced. An authenticated low-privilege author who holds only the replaceFiles permission on a shared folder can therefore overwrite the file content of a peer's asset in the same folder with attacker-controlled bytes, compromising content integrity (CVSS 4.0: 7.1 High) without disclosing data. Only Craft CMS deployments running the 5.x line below 5.10.11 are affected, and practical impact requires multi-author setups where less-privileged users can write to shared asset folders. No public PoC, CISA KEV listing, or in-the-wild exploitation is known; EPSS estimates roughly a 0.2% probability of exploitation within 30 days (10th percentile).

What to do: Upgrade Craft CMS to 5.10.11 or later. Until patched, restrict or withhold the replaceFiles permission on shared asset folders from low-privilege author accounts, and review recently replaced assets in shared folders for unexpected content changes. No public PoC or in-the-wild exploitation is currently known (EPSS ~0.2% over 30 days), so treat this as a prompt hygiene patch rather than an emergency.