PT-2026-27465 · Craft Cms · Craft Cms

Gcxwlp · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33160

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13

Description Craft CMS has an issue where an unauthenticated user can access transformed image bytes from private assets. This occurs by calling the /assets/generate-transform API endpoint with a private assetId. The endpoint does not verify access rights before providing a transform URL, allowing unauthorized access to content derived from private assets.

Recommendations Update Craft CMS to version 4.17.8 or later. Update Craft CMS to version 5.9.14 or later.

Exploit

Fix

Missing Authorization

IDOR

Weakness Enumeration

CWE-862

CWE-639

Related Identifiers

CVE-2026-33160

GHSA-5PGF-H923-M958

Affected Products

Craft Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33160.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-5pgf-h923-m958 · Vendor Advisory
• https://github.com/craftcms/cms/commit/7290d91639e · Patch
• https://osv.dev/vulnerability/GHSA-5pgf-h923-m958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33160 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33160 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/commit/7290d91639e5e3a4f7e221dfbef95c9b77331860 · Note
• https://github.com/craftcms/cms/releases/tag/5.9.14 · Note
• https://github.com/craftcms/cms/releases/tag/4.17.8 · Note