EUVD-2026-38179
GHSA-f4h3-qhg5-j6mq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires low-privilege authentication (PR:L); impact is limited to low confidentiality disclosure of private asset metadata with no integrity, availability, or scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an asset they are not permitted to view and still receive preview response data (previewHtml), including a private preview image route containing the target private assetId. Fixed in 5.9.14 and 4.17.8.
AnalysisAI
Authorization bypass in Craft CMS's assets/preview-file endpoint exposes private asset preview content to authenticated low-privileged users who lack view permission on the targeted asset. Affected installations running Craft CMS 4.0.0-RC1 through 4.17.7 or 5.0.0-RC1 through 5.9.13 with mixed-privilege users and private assets are vulnerable to unauthorized disclosure of preview HTML and private asset image routes. No public exploit or CISA KEV listing has been identified; patches are available in versions 4.17.8 and 5.9.14.
Technical ContextAI
The flaw is classified under CWE-639 (Authorization Bypass Through User-Controlled Key): the actionPreviewFile() method in src/controllers/AssetsController.php accepted a caller-supplied assetId parameter and rendered preview output without first verifying that the requesting user held viewAssets or viewPeerAssets permission on the relevant volume. The commit patch (d30df3112220db1ffd6726a3ed11857014c7fb27) confirms the fix adds $this->requireVolumePermissionByAsset('viewAssets', $asset) and $this->requirePeerVolumePermissionByAsset('viewPeerAssets', $asset) gating calls. The affected Composer package is craftcms/cms (CPE: cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*), covering both the 4.x and 5.x major release lines from their respective release-candidate origins.
RemediationAI
Upgrade Craft CMS to version 5.9.14 (5.x branch) or 4.17.8 (4.x branch), which introduce the missing per-asset authorization checks in the actionPreviewFile() controller method via patch commits d30df3112220db1ffd6726a3ed11857014c7fb27 and b1cddf72c98a66801beb04ea4b07e72182b7b7db. The vendor advisory is at https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq. If immediate patching is not feasible and the installation hosts private assets with mixed-privilege users, consider restricting access to the assets/preview-file route at the web server or reverse proxy layer for all but fully trusted user tiers - note this will break legitimate asset preview functionality for low-privileged users. Vendor-released patch: 5.9.14 / 4.17.8.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today