CVE-2026-33160

描述

### Summary An unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. ### Details Root cause: - Anonymous endpoint accepts user-controlled asset reference. - It creates and returns a transform URL for that asset without checking access rights. - If the transform output is reachable, guest users can read content derived from private assets. Who is impacted: - Installations where private source assets can be transformed and transform URLs are reachable. Security consequence: - Anonymous users can obtain content derived from private assets without authentication. ### Resources https://github.com/craftcms/cms/commit/7290d91639e

如何修補 CVE-2026-33160

要修補 CVE-2026-33160,請將受影響套件升級到下列已修補版本。

• —升級至 5.9.14 或更新版本

CVE-2026-33160 正在被利用嗎?

低 — EPSS 為 0.0%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 5.0.0-RC1, < 5.9.14

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-33160
• PATCHgithub.com/craftcms/cms
• WEBgithub.com/craftcms/cms/commit/7290d91639e5e3a4f7e221dfbef95c9b77331860
• WEBgithub.com/craftcms/cms/releases/tag/4.17.8
• WEB