MediumGHSA-53vf-c43h-j2x9CVE-2025-68436

Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Published 5 Jan 2026 · Updated 3 Feb 2026

Affected packages

craftcms/cmsComposer

Affected: >=5.0.0-RC1 <5.8.21
Fixed in: 5.8.21

Update to the fixed version for your release line, for example:composer require craftcms/cms:^5.8.21

craftcms/cmsComposer

Affected: >=4.0.0-RC1 <4.16.17
Fixed in: 4.16.17

Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.16.17

Details

Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Resources:

https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9

Is GHSA-53vf-c43h-j2x9 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.