VulnSocial

CVE-2026-50282Disclosure

LOWCVSS 4.9 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination. This issue has been resolved in versions 5.9.21 and 4.17.14.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-02: 2Technical Details · 2026-07-02: 207-02
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-50282 Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorizati… https://www.cve.org/CVERecord?id=CVE-2026-50282 ----- Traducción: CVE-2026-50282 Cra… http://infoflow.cloud`

    Post summary

    The tweet announces CVE‑2026‑50282, specifying affected Craft CMS versions but provides no patch, PoC, or evidence of exploitation.

    0000037
    91 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-50282 Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorizati… https://www.cve.org/CVERecord?id=CVE-2026-50282

    Post summary

    The brief CVE record outlines an authorization issue in Craft CMS affecting specific version ranges, but does not mention PoC, exploit, active exploitation, patch, or debunking.

    00000906
    57.7K followersView on X

Explore more

Back to dashboard