PT-2026-27465 · Craft Cms · Craft Cms

Gcxwlp · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2026-33160

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13

Description Craft CMS has an issue where an unauthenticated user can access transformed image bytes from private assets. This occurs by calling the /assets/generate-transform API endpoint with a private assetId. The endpoint does not verify access rights before providing a transform URL, allowing unauthorized access to content derived from private assets.

Recommendations Update Craft CMS to version 4.17.8 or later. Update Craft CMS to version 5.9.14 or later.

Exploit

Correção

IDOR

Missing Authorization

Enumeração de Fraquezas

CWE-639

CWE-862

Identificadores relacionados

CVE-2026-33160

GHSA-5PGF-H923-M958

Produtos afetados

Craft Cms

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33160.json · Exploit
• https://github.com/craftcms/cms · Nota
• https://github.com/craftcms/cms/releases/tag/5.9.14 · Nota
• https://github.com/craftcms/cms/security/advisories/GHSA-5pgf-h923-m958 · Aviso do Fabricante
• https://github.com/craftcms/cms/commit/7290d91639e · Correção
• https://github.com/craftcms/cms/releases/tag/4.17.8 · Nota
• https://github.com/craftcms/cms/commit/7290d91639e5e3a4f7e221dfbef95c9b77331860 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33160 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5pgf-h923-m958 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33160 · Aviso do Fabricante