{"id":"CVE-2026-33160","aliases":["GHSA-5pgf-h923-m958"],"url":"https://o3.security/vulnerability/CVE-2026-33160","summary":"Craft CMS: Anonymous \"generate transform\" calls for assets can expose private assets via transform URL","details":"### Summary\n\nAn unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes.\n\nThe endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL.\n\n### Details\n\nRoot cause:\n- Anonymous endpoint accepts user-controlled asset reference.\n- It creates and returns a transform URL for that asset without checking access rights.\n- If the transform output is reachable, guest users can read content derived from private assets.\n\nWho is impacted:\n\n- Installations where private source assets can be transformed and transform URLs are reachable.\n\nSecurity consequence:\n\n  - Anonymous users can obtain content derived from private assets without authentication.\n\n### Resources\n\nhttps://github.com/craftcms/cms/commit/7290d91639e","published":"2026-03-24T17:30:20.068Z","modified":"2026-08-12T03:51:40.179532377Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.9.14"},{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"4.17.8"}],"fix":{"url":"https://github.com/craftcms/cms/commit/7290d91639e","label":"craftcms/cms@7290d91"},"references":[{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/4.17.8"},{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/5.9.14"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33160.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-5pgf-h923-m958"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33160"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/7290d91639e"},{"type":"WEB","url":"https://github.com/craftcms/cms/commit/7290d91639e5e3a4f7e221dfbef95c9b77331860"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.179532377Z"}}