~ / search / GHSA-53vf-c43h-j2x9

GHSA-53vf-c43h-j2x9

Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-68436

Packages

EcosystemPackageAffectedFixed in
Packagist craftcms/cms >= 5.0.0-RC1, < 5.8.21 5.8.21
Packagist craftcms/cms >= 4.0.0-RC1, < 4.16.17 4.16.17

Details

As written in the advisory (Markdown source, shown as plain text).

Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Resources: https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9 https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9

References

External links from the advisory. They lead to third-party sites.