~ / search / GHSA-5pgf-h923-m958

GHSA-5pgf-h923-m958

Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

Source: GitHub Advisory Database (reviewed) Low CVE-2026-33160

Packages

EcosystemPackageAffectedFixed in
Packagist craftcms/cms >= 5.0.0-RC1, < 5.9.14 5.9.14
Packagist craftcms/cms >= 4.0.0-RC1, < 4.17.8 4.17.8

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary An unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. ### Details Root cause: - Anonymous endpoint accepts user-controlled asset reference. - It creates and returns a transform URL for that asset without checking access rights. - If the transform output is reachable, guest users can read content derived from private assets. Who is impacted: - Installations where private source assets can be transformed and transform URLs are reachable. Security consequence: - Anonymous users can obtain content derived from private assets without authentication. ### Resources https://github.com/craftcms/cms/commit/7290d91639e

References

External links from the advisory. They lead to third-party sites.