LowGHSA-5pgf-h923-m958CVE-2026-33160

Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

Published 24 Mar 2026 · Updated 25 Mar 2026

Affected packages

craftcms/cmsComposer
Affected
>=5.0.0-RC1 <5.9.14
Fixed in
5.9.14
Update to the fixed version for your release line, for example:composer require craftcms/cms:^5.9.14
craftcms/cmsComposer
Affected
>=4.0.0-RC1 <4.17.8
Fixed in
4.17.8
Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.17.8

Details

Summary

An unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes.

The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL.

Details

Root cause:

  • Anonymous endpoint accepts user-controlled asset reference.
  • It creates and returns a transform URL for that asset without checking access rights.
  • If the transform output is reachable, guest users can read content derived from private assets.

Who is impacted:

  • Installations where private source assets can be transformed and transform URLs are reachable.

Security consequence:

  • Anonymous users can obtain content derived from private assets without authentication.

Resources

https://github.com/craftcms/cms/commit/7290d91639e

Is GHSA-5pgf-h923-m958 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.