CVE-2026-33160

Description

### Summary An unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. ### Details Root cause: - Anonymous endpoint accepts user-controlled asset reference. - It creates and returns a transform URL for that asset without checking access rights. - If the transform output is reachable, guest users can read content derived from private assets. Who is impacted: - Installations where private source assets can be transformed and transform URLs are reachable. Security consequence: - Anonymous users can obtain content derived from private assets without authentication. ### Resources https://github.com/craftcms/cms/commit/7290d91639e

How to fix CVE-2026-33160

To remediate CVE-2026-33160, upgrade the affected package to a fixed version below.

• —upgrade to 5.9.14 or later

Is CVE-2026-33160 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 5.0.0-RC1, < 5.9.14

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-33160
• PATCHgithub.com/craftcms/cms
• WEBgithub.com/craftcms/cms/commit/7290d91639e5e3a4f7e221dfbef95c9b77331860
• WEBgithub.com/craftcms/cms/releases/tag/4.17.8
• WEB