PT-2026-38287 · Craft Cms · Craft Cms

Published 2026-05-06 · Updated 2026-05-12 · CVE-2026-44012

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.9.17

Description The actionShowInFolder() function within the AssetsController fetches an asset by ID and returns its filename and complete folder hierarchy, including volume handle, volume UID, folder names, folder UIDs, and folder URI paths. This process occurs without verifying if the requesting user possesses viewAssets or viewPeerAssets permissions on the asset's volume. Consequently, any authenticated control panel user, regardless of their volume permissions, can enumerate asset filenames and the full folder structure of any volume by providing arbitrary asset IDs. This exposure includes sensitive structural data such as private document repositories and confidential media, which could facilitate further targeted attacks to exfiltrate files.

Recommendations Update to version 5.9.18. As a temporary workaround, restrict access to the actionShowInFolder() function within the AssetsController to minimize the risk of unauthorized data enumeration.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-44012

GHSA-33M5-HQP9-97PW

Affected Products

Craft Cms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-44012 · Security Note
• https://osv.dev/vulnerability/GHSA-33m5-hqp9-97pw · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/commit/e3f3eaab3d85badd713cfc2c24e5f0792ecdb586 · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-33m5-hqp9-97pw · Note
• https://twitter.com/CVEnew/status/2054324024428417172 · Twitter Post