Tóm tắt nhanh
- CVE-2026-33158 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng craftcms/cms, craft cms (craftcms).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.36%, cao hơn 29.6% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 4.17.8, 5.9.14 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| craftcms/cms Packagist | ≥ 4.0.0-RC1, < 4.17.8≥ 5.0.0-RC1, < 5.9.14
| 4.17.85.9.14
|
| craft cms | = 4.0.0= 5.0.0> 4.0.0, < 4.17.8> 5.0.0, < 5.9.14
| 4.17.85.9.14
|
Mô tả
Summary
A low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view.
The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files.
Details
Root cause:
- A user-controlled object reference (
assetId) is used to load and return sensitive content.
- The action does not verify whether the current user is authorized to view that asset.
- This creates an authenticated IDOR / authorization bypass.
Impact
- Craft installations where private/non-public assets exist and low-privileged users can authenticate.
Resources
https://github.com/craftcms/cms/commit/7290d91639e
Mô tả của NVD
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view. The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files. This issue has been patched in versions 4.17.8 and 5.9.14.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí