Silverstripe Assets Module has a DBFile::getURL() permission bypass
Impact
Images rendered in templates or otherwise accessed via DBFile::getURL() or DBFile::getSourceURL() incorrectly add an access grant to the current session, which bypasses file permissions.
This usually happens when creating an image variant, for example using a manipulation method like ScaleWidth() or Convert().
Note that if you use DBFile directly in the $db configuration for a DataObject class that doesn't subclass File, and if you were setting the visibility of those files to "protected", those files will now need an explicit access grant to be accessed. If you do not want to explicitly provide access grants for these files (i.e. you want these files to be accessible by default), you should use the "public" visibility.
Reported by
Restruct web & apps
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | silverstripe/assets | < 2.4.5, >= 3.0.0, < 3.1.3 | 2.4.5, 3.1.3 |
References
- https://github.com/silverstripe/silverstripe-assets/security/advisories/GHSA-jgcf-rf45-2f8v
- https://nvd.nist.gov/vuln/detail/CVE-2026-24749
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2026-24749.yaml
- https://github.com/silverstripe/silverstripe-assets
- https://www.silverstripe.org/download/security-releases/cve-2026-24749
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-266, CWE-863- Platform
- Composer
- Package
silverstripe/assets- Disclosed
- 16.04.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-jgcf-rf45-2f8v - CC BY 4.0
Vulnerability history: silverstripe/assets
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 11.2019 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 5
Disclosures per year
- 2019: 1
- 2020: 0
- 2021: 0
- 2022: 4
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
Silverstripe Assets Module has a DBFile::getURL() permission bypass this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.