The vulnerability is an authorization flaw allowing a forced folder move that overwrites an existing destination folder without delete permission. The action can delete the conflicting destination folder, and it is inferred that this deletion includes the folder’s entire subtree of assets, potentially causing content loss and disruption to the website. The weakness is classified as CWE‑862: Missing Authorization.

The affected systems include the Craft CMS product (vendor Craft CMS). Versions 5.0.0‑RC1 through 5.9.20, inclusive, and versions 4.0.0‑RC1 through 4.17.13, inclusive, contain the flaw.

The CVSS score of 4.9 classifies the flaw as moderate. The EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would need authenticated access to the CMS, as the move operation occurs through the web interface and requires the ability to set the force parameter. Additionally, it is inferred that the primary risk stems from accidental or malicious data deletion rather than advanced exploitation techniques.