VYPR
Get started
← All advisories
Low severityNVD Advisory· Published Mar 24, 2026· Updated Mar 26, 2026

Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL

CVE-2026-33160

Description

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. This issue has been patched in versions 4.17.8 and 5.9.14.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
craftcms/cmsPackagist
>= 5.0.0-RC1, < 5.9.145.9.14
craftcms/cmsPackagist
>= 4.0.0-RC1, < 4.17.84.17.8

Affected products

1

Patches

1
7290d91639e5

Merge branch 'advisory/GHSA-5pgf-h923-m958' into 4.x

https://github.com/craftcms/cmsbrandonkellyFeb 25, 2026via ghsa
commit
2 files changed · +2 −1
  • CHANGELOG.md+1 −1 modified
    @@ -4,7 +4,7 @@
 
 - The `PDO::MYSQL_ATTR_MULTI_STATEMENTS` attribute is no longer set by default for database connections. ([#18474](https://github.com/craftcms/cms/issues/18474))
 - Fixed a [moderate-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) access control vulnerability. (GHSA-6mrr-q3pj-h53w)
-- Fixed a [moderate-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) information disclosure vulnerability. (GHSA-3pvf-vxrv-hh9c)
+- Fixed [moderate-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) information disclosure vulnerabilities. (GHSA-3pvf-vxrv-hh9c, GHSA-5pgf-h923-m958)
 
 ## 4.17.7 - 2026-02-24
  • src/controllers/AssetsController.php+1 −0 modified
    @@ -1149,6 +1149,7 @@ public function actionGenerateTransform(?int $transformId = null): Response
                 throw new ServerErrorHttpException('Image transform cannot be created.', previous: $e);
             }
         } else {
+            $this->requirePermission('accessCp');
             $assetId = $this->request->getRequiredBodyParam('assetId');
             $handle = $this->request->getRequiredBodyParam('handle');
             if (!is_string($handle)) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.