PT-2026-33347 · Silverstripe · Silverstripe Assets Module

Published 2026-04-16 · Updated 2026-04-17 · CVE-2026-24749

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe Assets Module versions prior to 2.4.5 Silverstripe Assets Module versions 3.0.0-rc1 through 3.1.2

Description Images rendered in templates or accessed via 'DBFile::getURL()' or 'DBFile::getSourceURL()' incorrectly add an access grant to the current session, allowing the bypass of file permissions. This typically occurs during the creation of an image variant, such as when using manipulation methods like ScaleWidth() or Convert(). Additionally, if DBFile is used in the $db configuration for a DataObject class that does not subclass File and visibility is set to protected, those files require an explicit access grant for access.

Recommendations Update to version 2.4.5 Update to version 3.1.3 Set file visibility to public if explicit access grants are not desired for files using DBFile in a DataObject class that does not subclass File.

Exploit

Fix

Incorrect Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-863

CWE-266

Related Identifiers

CVE-2026-24749

GHSA-JGCF-RF45-2F8V

Affected Products

Silverstripe Assets Module

References · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2026-24749.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-24749 · Security Note
• https://osv.dev/vulnerability/GHSA-jgcf-rf45-2f8v · Vendor Advisory
• https://github.com/silverstripe/silverstripe-assets · Note
• https://github.com/silverstripe/silverstripe-assets/security/advisories/GHSA-jgcf-rf45-2f8v · Note
• https://twitter.com/CVEnew/status/2045102668897460403 · Twitter Post
• https://silverstripe.org/download/security-releases/cve-2026-24749 · Note