VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Mar 24, 2026· Updated Jun 17, 2026

CVE-2026-33160

CVE-2026-33160

Description

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. This issue has been patched in versions 4.17.8 and 5.9.14.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
craftcms/cmsPackagist
>= 5.0.0-RC1, < 5.9.145.9.14
craftcms/cmsPackagist
>= 4.0.0-RC1, < 4.17.84.17.8

Affected products

9
  • Craftcms/Craft CMS7 versions
    cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*range: >4.0.0,<4.17.8
    • cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*
    • cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*
    • cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*
  • ghsa-coords
    pkg:composer/craftcms/cms
    Range: >= 5.0.0-RC1, < 5.9.14
  • Craftcms/CMSv5
    Range: >= 4.0.0-RC1, < 4.17.8

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.