Iniciar sesión
Deutsch English Español Polski
Baja

Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

  • Publicada: 24.03.2026
  • Actualizado: 11.10.2026 10:22

Summary

An unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes.

The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL.

Details

Root cause:

  • Anonymous endpoint accepts user-controlled asset reference.
  • It creates and returns a transform URL for that asset without checking access rights.
  • If the transform output is reachable, guest users can read content derived from private assets.

Who is impacted:

  • Installations where private source assets can be transformed and transform URLs are reachable.

Security consequence:

  • Anonymous users can obtain content derived from private assets without authentication.

Resources

https://github.com/craftcms/cms/commit/7290d91639e

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer craftcms/cms >= 5.0.0-RC1, < 5.9.14, >= 4.0.0-RC1, < 4.17.8 5.9.14, 4.17.8

Referencias

Puntuación CVSS -
Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Debilidad (CWE)
CWE-639, CWE-862
Plataforma
Composer
Paquete
craftcms/cms
Publicada
24.03.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-5pgf-h923-m958 - CC BY 4.0

Historial de vulnerabilidades: craftcms/cms

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (127) en el archivo
Entradas en total
127
Primera → última
07.2021 08.2026
Sin corrección
6
Explotada en ataques
4

Distribución por gravedad

  • Crítica 9
  • Alta 41
  • Media 65
  • Baja 12

Divulgaciones por año

Gravedad:
  1. Craft CMS: Passkey login accepts replayed WebAuthn assertions
    Crítica CVE-2026-72780 >= 5.0.0-RC1, < 5.10.5 5.10.5
  2. Craft CMS: Arbitrary user password reset leading to administrator account takeover
    Alta CVE-2026-72786 >= 5.0.0-RC1, < 5.10.8 5.10.8
  3. Craft CMS: Authenticated RCE through Twig sandbox escape
    Alta CVE-2026-72781 >= 5.0.0-RC1, < 5.10.7, >= 4.0.0-RC1, < 4.18.3 5.10.7, 4.18.3
  4. Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
    Alta CVE-2026-72778 >= 5.0.0-RC1, < 5.10.6, >= 4.0.0-RC1, < 4.18.2 5.10.6, 4.18.2
  5. Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
    Alta CVE-2026-56382 >= 5.5.0, < 5.9.14 5.9.14
  6. Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
    Alta CVE-2026-55794 >= 5.9.0, < 5.10.0 5.10.0
  7. Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
    Alta CVE-2026-55790 >= 5.0.0-RC1, < 5.9.23, >= 4.0.0-RC1, < 4.17.16 5.9.23, 4.17.16
  8. Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
    Alta CVE-2026-50282 >= 5.0.0-RC1, < 5.9.21, >= 4.0.0-RC1, < 4.17.14 5.9.21, 4.17.14
  9. Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
    Alta CVE-2026-50281 >= 5.7.0, < 5.9.21 5.9.21
  10. Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
    Alta CVE-2026-50284 >= 5.0.0-RC1, < 5.9.22, >= 4.0.0-RC1, < 4.17.15 5.9.22, 4.17.15
  11. Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
    Alta CVE-2026-50279 >= 5.0.0-RC1, < 5.9.21 5.9.21
  12. Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
    Crítica CVE-2026-55791 >= 5.0.0-RC1, < 5.10, >= 4.0.0-RC1, < 4.18 5.10, 4.18
  13. Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
    Alta CVE-2026-44012 >= 5.0.0-RC1, < 5.9.18 5.9.18
  14. Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
    Alta CVE-2026-44011 >= 4.0.0, < 4.17.12, >= 5.0.0, < 5.9.18 4.17.12, 5.9.18
  15. Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
    Alta CVE-2026-44010 >= 5.0.0, < 5.9.18, >= 4.0.0, < 4.17.12 5.9.18, 4.17.12
  16. Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL esta entrada
    Baja CVE-2026-33160 >= 5.0.0-RC1, < 5.9.14, >= 4.0.0-RC1, < 4.17.8 5.9.14, 4.17.8
  17. Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
    Alta CVE-2026-33157 >= 5.6.0, < 5.9.13 5.9.13
  18. Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
    Alta CVE-2026-32267 >= 4.0.0-RC1, < 4.17.6, >= 5.0.0-RC1, < 5.9.12 4.17.6, 5.9.12
  19. Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
    Alta CVE-2026-32264 >= 4.0.0-RC1, < 4.17.5, >= 5.0.0-RC1, < 5.9.11 4.17.5, 5.9.11
  20. Craft CMS vulnerable to behavior injection RCE via EntryTypesController
    Alta CVE-2026-32263 >= 5.6.0, < 5.9.11 5.9.11
Mostrar más (20) Mostrando 20 de 51

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.