PT-2026-27463 · Craft Cms · Craft Cms

Gcxwlp · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33158

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13

Description A low-privileged authenticated user can access private asset content by calling the /assets/edit-image API endpoint with an arbitrary assetId without proper authorization checks. The endpoint returns image bytes or a preview redirect, potentially disclosing private files. The issue stems from a lack of verification that the current user is authorized to view the requested asset.

Recommendations Update Craft CMS to version 4.17.8 or later. Update Craft CMS to version 5.9.14 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-33158

GHSA-3PVF-VXRV-HH9C

Affected Products

Craft Cms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33158.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-3pvf-vxrv-hh9c · Vendor Advisory
• https://github.com/craftcms/cms/commit/7290d91639e5e3a4f7e221dfbef95c9b77331860 · Patch
• https://osv.dev/vulnerability/GHSA-3pvf-vxrv-hh9c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33158 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33158 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.9.14 · Note
• https://github.com/craftcms/cms/releases/tag/4.17.8 · Note