CVE-2026-33160
EPSS 0.02%Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
Description
### Summary An unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. ### Details Root cause: - Anonymous endpoint accepts user-controlled asset reference. - It creates and returns a transform URL for that asset without checking access rights. - If the transform output is reachable, guest users can read content derived from private assets. Who is impacted: - Installations where private source assets can be transformed and transform URLs are reachable. Security consequence: - Anonymous users can obtain content derived from private assets without authentication. ### Resources https://github.com/craftcms/cms/commit/7290d91639e
Affected packages (1)
- Packagist/craftcms/cms>= 5.0.0-RC1, < 5.9.14
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U |
References (6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-33160
- PATCHhttps://github.com/craftcms/cms
- WEBhttps://github.com/craftcms/cms/commit/7290d91639e5e3a4f7e221dfbef95c9b77331860
- WEBhttps://github.com/craftcms/cms/releases/tag/4.17.8
- WEBhttps://github.com/craftcms/cms/releases/tag/5.9.14
- WEBhttps://github.com/craftcms/cms/security/advisories/GHSA-5pgf-h923-m958