Craft CMS’s AssetsController::actionReplaceFile allows an authenticated user with file‑replacement rights to delete a source asset when both assetId and sourceAssetId are supplied. The method first loads the specified assets, then checks replace permissions only on the target asset, because ($assetToReplace ?: $sourceAsset) evaluates to the target. Since there is no permission check for deleting the source asset, the source file is copied to the target and the source asset is removed without the user having delete permission. This enables an attacker who can replace files in one volume to delete assets in another volume where delete rights are absent, causing broken content references and data loss.

Versions 4.0.0‑RC1 to 4.17.13 and 5.0.0‑RC1 to 5.9.20 of Craft issue is fixed in Craft CMS 4.17.14 and 5.9.21, which should be deployed to eliminate the vulnerability.

The CVSS score of 5.3 reflects moderate risk. The EPSS score is below 1%, meaning the probability of exploitation is low. An authenticated user with file‑replacement rights can delete a source asset in another volume where delete permission is absent, leading to irreversible data loss.