Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Vulnerability

Overview

CVE-2025-68436 is an information disclosure vulnerability affecting Craft CMS, a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users can potentially expose sensitive assets on a Craft installation by submitting maliciously crafted requests related to their user profile photo [1][2]. The root cause lies in the user model's handling of the photoId attribute, which was not properly restricted during mass assignment. The fix, visible in the commit adds a safeAttributes() method that explicitly excludes photoId from the list of safe attributes, preventing attackers from manipulating it via bulk assignment [4].

Exploitation and

Attack Surface

To exploit this vulnerability, an attacker must be an authenticated user on the Craft installation. No special crafted requests targeting the user profile photo functionality can cause the application to relocate or expose assets that should not be accessible to that user. The attack does not require any special privileges beyond a valid user account [1][2]. The vulnerability is present in both the 5.x and 4.x release lines, covering a wide range of versions.

Impact

Successful exploitation could lead to the disclosure of sensitive assets, such as files or images that are normally restricted. This could include private media, configuration files, or other resources stored on the server. The exact scope of exposed assets depends on the specific Craft installation and its asset configuration [1][1][2].

Mitigation

The vulnerability has been patched in Craft CMS versions 5.8.21 and 4.16.17. Users are strongly advised to update to these patched versions immediately. No workarounds have been publicly documented, and the vendor recommends updating as the sole mitigation [1][2]. The fix is included in the official repository commit [4].