PT-2026-27465 · Craft Cms · Craft Cms

Gcxwlp · CVE-2026-33160 · Published 2026-03-24 · Updated 2026-03-24

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13

Description Craft CMS has an issue where an unauthenticated user can access transformed image bytes from private assets. This occurs by calling the /assets/generate-transform API endpoint with a private assetId. The endpoint does not verify access rights before providing a transform URL, allowing unauthorized access to content derived from private assets.

Recommendations Update Craft CMS to version 4.17.8 or later. Update Craft CMS to version 5.9.14 or later.

Exploit

Fix

IDOR

Missing Authorization

Weakness Enumeration

CWE-639

CWE-862

Related Identifiers

CVE-2026-33160

GHSA-5PGF-H923-M958

Affected Products

Craft Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33160.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-5pgf-h923-m958 · Vendor Advisory
• https://github.com/craftcms/cms/commit/7290d91639e · Patch
• https://osv.dev/vulnerability/GHSA-5pgf-h923-m958 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33160 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/4.17.8 · Note
• https://github.com/craftcms/cms/commit/7290d91639e5e3a4f7e221dfbef95c9b77331860 · Note
• https://github.com/craftcms/cms/releases/tag/5.9.14 · Note