Craft CMS EUVD-2026-38179

Exploitation requires a valid authenticated session for a low-privileged user account (PR:L per CVSS vector) on a Craft CMS installation that meets two conditions: it must have at least one private asset volume with restricted view permissions, and at least one authenticated user whose canView permission for that volume resolves to false. The attacker must supply a valid or guessable assetId integer for a private asset in a POST to assets/preview-file. Unauthenticated attackers cannot exploit this vulnerability. Impact is bounded to disclosure of preview HTML and private asset image route metadata - no write access, code execution, or privilege escalation is achievable. Installations without private assets, or single-role environments where all users share identical volume permissions, are not exposed to meaningful risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 5.3) accurately characterizes this as a moderate-severity, network-accessible information disclosure requiring low-privilege authentication with no integrity or availability impact. No EPSS data was provided in available intelligence sources. The vulnerability is not listed in CISA KEV and no POC has been identified, making this a low-urgency issue in the absence of active exploitation signals. Real-world risk is meaningful only to organizations using Craft CMS with private/restricted asset volumes and multi-privilege user environments; single-tenant or fully public installations face no practical exposure. The CVSS score is consistent with the actual impact - no code execution, privilege escalation, or data modification is possible.

An authenticated low-privileged Craft CMS user (e.g., a contributor account with no volume view permission) issues POST requests to the assets/preview-file endpoint supplying incrementing or enumerated assetId values. The endpoint returns previewHtml containing a private image preview URL that embeds the target assetId, revealing that the asset exists and exposing its preview metadata. No POC has been identified, but the attack requires only a valid session cookie and knowledge of or ability to enumerate numeric asset IDs.