Skip to content

Commit eb95d6f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-44px-qjjc-xrhq GHSA-f4h3-qhg5-j6mq GHSA-jcmp-jxh2-4jc3 GHSA-c43v-4cr8-6mvp GHSA-f4h3-qhg5-j6mq GHSA-jcmp-jxh2-4jc3
1 parent f1fce6c commit eb95d6f

6 files changed

Lines changed: 160 additions & 100 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-44px-qjjc-xrhq/GHSA-44px-qjjc-xrhq.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-44px-qjjc-xrhq",
4-
"modified": "2026-03-26T17:12:21Z",
4+
"modified": "2026-08-06T21:56:28Z",
55
"published": "2026-03-26T17:12:21Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-56385"
8+
],
79
"summary": "Craft CMS: Authorized asset \"preview file\" requests bypass allows users without asset access to retrieve private preview metadata",
810
"details": "### Summary\n\nAn authenticated low-privileged user can call `assets/preview-file` for an asset they are not authorized to view and still receive preview response data (`previewHtml`) for that private asset.\n\nThe returned preview HTML included a private preview image route containing the target private `assetId`, even though `canView` was `false` for the attacker account.\n\n### Details\n\n1. `assets/preview-file` accepts a maliciously controlled `assetId` and renders preview output.\n2. The action does not enforce per-asset view authorization prior to returning preview content.\n 3. As a result, an authenticated user without asset-view permission can still obtain private preview output.\n\nThis affects Craft installations with authenticated users of mixed privilege levels with private assets.\n\n### Resources\n\n- d30df3112220db1ffd6726a3ed11857014c7fb27\n- b1cddf72c98a",
911
"severity": [
@@ -63,6 +65,10 @@
6365
"type": "WEB",
6466
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq"
6567
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56385"
71+
},
6672
{
6773
"type": "WEB",
6874
"url": "https://github.com/craftcms/cms/commit/b1cddf72c98a66801beb04ea4b07e72182b7b7db"
@@ -74,6 +80,10 @@
7480
{
7581
"type": "PACKAGE",
7682
"url": "https://github.com/craftcms/cms"
83+
},
84+
{
85+
"type": "WEB",
86+
"url": "https://www.vulncheck.com/advisories/craft-cms-authorization-bypass-in-assets-preview-file-endpoint"
7787
}
7888
],
7989
"database_specific": {

‎advisories/github-reviewed/2026/06/GHSA-f4h3-qhg5-j6mq/GHSA-f4h3-qhg5-j6mq.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f4h3-qhg5-j6mq",
4+
"modified": "2026-08-06T21:56:22Z",
5+
"published": "2026-06-21T15:31:24Z",
6+
"withdrawn": "2026-08-06T21:56:22Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: Craft CMS: Authorized asset \"preview file\" requests bypass allows users without asset access to retrieve private preview metadata",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-44px-qjjc-xrhq. This link is maintained to preserve external references.\n\n## Original Description\nCraft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an asset they are not permitted to view and still receive preview response data (previewHtml), including a private preview image route containing the target private assetId. Fixed in 5.9.14 and 4.17.8.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "Packagist",
24+
"name": "craftcms/cms"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "5.0.0-RC1"
32+
},
33+
{
34+
"last_affected": "5.9.13"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56385"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/craft-cms-authorization-bypass-in-assets-preview-file-endpoint"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-639"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-08-06T21:56:22Z",
66+
"nvd_published_at": "2026-06-21T14:16:26Z"
67+
}
68+
}

‎advisories/github-reviewed/2026/06/GHSA-jcmp-jxh2-4jc3/GHSA-jcmp-jxh2-4jc3.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jcmp-jxh2-4jc3",
4+
"modified": "2026-08-06T21:58:01Z",
5+
"published": "2026-06-21T15:31:25Z",
6+
"withdrawn": "2026-08-06T21:58:01Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-c43v-4cr8-6mvp. This link is maintained to preserve external references.\n\n## Original Description\nCraft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "Packagist",
24+
"name": "craftcms/cms"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "4.0.0-RC1"
32+
},
33+
{
34+
"last_affected": "4.17.6"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56394"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/craft-cms-authenticated-path-traversal-in-assets-icon-extension-parameter"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-22"
62+
],
63+
"severity": "HIGH",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-08-06T21:58:01Z",
66+
"nvd_published_at": "2026-06-21T14:16:26Z"
67+
}
68+
}

‎advisories/github-reviewed/2026/07/GHSA-c43v-4cr8-6mvp/GHSA-c43v-4cr8-6mvp.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-c43v-4cr8-6mvp",
4-
"modified": "2026-07-09T13:44:06Z",
4+
"modified": "2026-08-06T21:58:07Z",
55
"published": "2026-07-09T13:44:06Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-56394"
8+
],
79
"summary": "Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read",
810
"details": "### Summary\n\nAn authenticated path traversal in `assets/icon` allows local SVG file read by passing traversal sequences in the `extension` parameter. The issue is caused by file existence checks happening before extension validation.\n\n### Details\nThe endpoint:\n- `src/controllers/AssetsController.php:1115-1123`\n- `actionIcon(string $extension)` calls `Assets::iconPath($extension)` and returns `sendFile($path, ...)`.\n\nIn `Assets::iconPath()`:\n- Path is built from user-controlled `extension`:\n - `src/helpers/Assets.php:906-909`\n- If `file_exists($path)` is true, path is returned immediately:\n - `src/helpers/Assets.php:910-912`\n\nValidation exists in `Assets::iconSvg()`:\n - `preg_match('/^\\w+$/', $extension)`\n - `src/helpers/Assets.php:927-931`\n\nHowever, that validation is only reached if `iconPath()` does **not** find a file.\nSo traversal payloads that resolve to existing `.svg` files bypass validation and are served by `sendFile()`.\n\n### Impact\n\n- Authenticated users can read local .svg files accessible to the application process.\n\n### References\n\n- https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c",
911
"severity": [
@@ -63,13 +65,21 @@
6365
"type": "WEB",
6466
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp"
6567
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56394"
71+
},
6672
{
6773
"type": "WEB",
6874
"url": "https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c"
6975
},
7076
{
7177
"type": "PACKAGE",
7278
"url": "https://github.com/craftcms/cms"
79+
},
80+
{
81+
"type": "WEB",
82+
"url": "https://www.vulncheck.com/advisories/craft-cms-authenticated-path-traversal-in-assets-icon-extension-parameter"
7383
}
7484
],
7585
"database_specific": {

‎advisories/unreviewed/2026/06/GHSA-f4h3-qhg5-j6mq/GHSA-f4h3-qhg5-j6mq.json‎

Lines changed: 0 additions & 48 deletions
This file was deleted.

‎advisories/unreviewed/2026/06/GHSA-jcmp-jxh2-4jc3/GHSA-jcmp-jxh2-4jc3.json‎

Lines changed: 0 additions & 48 deletions
This file was deleted.

0 commit comments

Comments
 (0)