PT-2026-25818 · Craft Cms+1 · Craft Cms+1

Neosprings · Publicado 2026-03-16 · Atualizado 2026-03-18 · CVE-2026-32268

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Azure Blob Storage for Craft CMS plugin versions prior to 2.1.1

Description The Azure Blob Storage for Craft CMS plugin integrates Azure Blob Storage with Craft CMS. Versions prior to 2.1.1 allow unauthenticated users to view a list of buckets the plugin has access to. The /DefaultController->actionLoadContainerData() API endpoint permits unauthenticated users possessing a valid CSRF token to enumerate accessible buckets. Due to the potential for sensitive data exposure in Azure error messages, additional attack vectors may be present.

Recommendations Update to version 2.1.1 of the plugin.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-32268

GHSA-Q6FM-P73F-X862

Produtos afetados

Azure Blob Storage For Craft Cms

Craft Cms

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32268.json · Exploit
• https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff · Nota
• https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862 · Nota
• https://github.com/craftcms/azure-blob · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32268 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-q6fm-p73f-x862 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2034167401525215613 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1rvkawc/resumen_diario_de_vulnerabilidades_16032026 · Publicação no Reddit
• https://twitter.com/VulmonFeeds/status/2034252797609132412 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32268 · Aviso do Fabricante