Craft CMS versions from 5.0.0‑RC1 through 5.10.10 allow a missing authorization check in AssetsController::actionReplaceFile. When a request includes sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the controller’s permission checks run, so the required replacePeerFiles permission is never enforced. An authenticated user with only the replaceFiles permission on a shared folder can therefore overwrite the contents of a peer’s asset file in that folder with attacker‑controlled data, potentially corrupting site content or inserting malicious code. The vulnerability directly impacts data integrity, and if the overwritten asset is later served or executed by the CMS, it can lead to broader compromise.

Craft CMS 5.x, including all releases from 5.0.0‑RC1 up to and excluding 5.10.11. The affected product is listed as craftcms:cms. Users running any of these versions should verify whether they have the replaceFiles permission enabled on shared folders.

The CVSS score of 7.1 signifies a high risk severity. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated low‑privilege author who holds the replaceFiles permission on a shared folder; no additional privileges or remote conditions are needed. Because the flaw permits only file overwrite, the impact is limited to integrity and potential upstream code injection if overwritten assets are later executed.