Is CVE-2026-32262 actively exploited?

No active exploitation of CVE-2026-32262 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32262 be exploited remotely?

Yes. CVE-2026-32262 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32262?

CVE-2026-32262 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-32262

MEDIUM

CVE-2026-32262

CWE-22Published: March 16, 2026· Updated: Mar 17, 2026

4.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.0th

Official Description

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAssetName() is applied on save. This allows an authenticated user with replaceFiles permission to delete arbitrary files within the same filesystem root by injecting ../ path traversal sequences into the filename. This could allow an authenticated user with replaceFiles permission on one volume to delete files in other folders/volumes that share the same filesystem root. This only affects local filesystems. This issue has been patched in versions 4.17.5 and 5.9.11.

NVD Source

Technical Analysis

CVE-2026-32262 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.