CVE-2026-50283: Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

July 2, 2026

We have identified an authorization issue in Craft CMS AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.

References

github.com/advisories/GHSA-qh45-9g5p-m2v4
github.com/craftcms/cms/commit/2c2579c7f1030872423f268d0c8b48377101961d
github.com/craftcms/cms/security/advisories/GHSA-qh45-9g5p-m2v4
nvd.nist.gov/vuln/detail/CVE-2026-50283

Code Behaviors & Features

Detect and mitigate CVE-2026-50283 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →