PT-2026-27466 · Craft Cms · Craft Cms

Susen2 · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2026-33161

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13

Description A low-privileged authenticated user can access editor response data, including focalPoint, for private assets they are not authorized to view. The /assets/image-editor API endpoint returns private editing metadata without proper authorization checks. The issue stems from the actionImageEditor() function accepting an assetId without validating the user's access rights to the corresponding asset before returning data such as html and focalPoint.

Recommendations Update to Craft CMS version 4.17.8 or later. Update to Craft CMS version 5.9.14 or later.

Exploit

Correção

Information Disclosure

Missing Authorization

Enumeração de Fraquezas

CWE-200

CWE-862

Identificadores relacionados

CVE-2026-33161

GHSA-VGJG-248P-RFM2

Produtos afetados

Craft Cms

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33161.json · Exploit
• https://github.com/craftcms/cms · Nota
• https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27 · Correção
• https://github.com/craftcms/cms/releases/tag/5.9.14 · Nota
• https://github.com/craftcms/cms/security/advisories/GHSA-vgjg-248p-rfm2 · Aviso do Fabricante
• https://github.com/craftcms/cms/releases/tag/4.17.8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33161 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33161 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vgjg-248p-rfm2 · Aviso do Fabricante