CVE-2026-84800 | Craft CMS up to 5.10.10 AssetsController actionReplaceFile assetId improper authorization

A vulnerability, which was classified as problematic, has been found in Craft CMS up to 5.10.10. The affected element is the function AssetsController::actionReplaceFile of the component AssetsController. The manipulation of the argument assetId leads to improper authorization.

This vulnerability is listed as CVE-2026-84800. The attack may be initiated remotely. There is no available exploit.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More