Tóm tắt nhanh
- CVE-2026-56384 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng craftcms/cms.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.33%, cao hơn 26.3% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 4.17.8, 5.9.14 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| craftcms/cms Packagist | ≥ 4.0.0-RC1, < 4.17.8≥ 5.0.0-RC1, < 5.9.14
| 4.17.85.9.14
|
Mô tả
Summary
A user with Control Panel access but without permission to view a target private asset can call assets/preview-thumb and receive preview HTML that contains a signed fallback transform link for that private asset.
Details
Root-cause analysis:
- The endpoint accepts an attacker-controlled
assetId.
- Asset is resolved, and thumbnail HTML is returned.
- No explicit asset-view permission check is performed before preview generation.
Impact
Type:
- Missing authorization
- Unauthorized preview-link disclosure
Affected deployments:
- Craft sites with control panel users who have partial permissions and private assets.
Security consequence:
- A control panel user without asset-view permission can still obtain signed preview transform link data for private assets.
- This may increase private asset exposure risk depending on deployment and endpoint chaining.
Resources
https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27
Mô tả của NVD
Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset, because no asset-view permission check is performed before preview generation. This affects versions >= 4.0.0-RC1, <= 4.17.7 and >= 5.0.0-RC1, <= 5.9.13, and is fixed in 4.17.8 and 5.9.14.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí