PT-2026-27463 · Craft Cms · Craft Cms

Gcxwlp · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2026-33158

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13

Description A low-privileged authenticated user can access private asset content by calling the /assets/edit-image API endpoint with an arbitrary assetId without proper authorization checks. The endpoint returns image bytes or a preview redirect, potentially disclosing private files. The issue stems from a lack of verification that the current user is authorized to view the requested asset.

Recommendations Update Craft CMS to version 4.17.8 or later. Update Craft CMS to version 5.9.14 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-33158

GHSA-3PVF-VXRV-HH9C

Produtos afetados

Craft Cms

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33158.json · Exploit
• https://github.com/craftcms/cms · Nota
• https://github.com/craftcms/cms/releases/tag/5.9.14 · Nota
• https://github.com/craftcms/cms/commit/7290d91639e5e3a4f7e221dfbef95c9b77331860 · Correção
• https://github.com/craftcms/cms/security/advisories/GHSA-3pvf-vxrv-hh9c · Aviso do Fabricante
• https://github.com/craftcms/cms/releases/tag/4.17.8 · Nota
• https://osv.dev/vulnerability/GHSA-3pvf-vxrv-hh9c · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33158 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33158 · Nota de Segurança