GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-5pgf-h923-m958low2.7

Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

Impact

An unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes.

Source excerpt · OSV

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

craftcms/cms Packagist
Affected rangeRecorded fix
From 5.0.0-RC1 before 5.9.14Ecosystem versions5.9.14
From 4.0.0-RC1 before 4.17.8Ecosystem versions4.17.8

Version evidence: OSV · GHSA-5pgf-h923-m958

View original version evidence (400 explicit versions)

Original source description

Summary

An unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes.

The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL.

Details

Root cause:

  • Anonymous endpoint accepts user-controlled asset reference.
  • It creates and returns a transform URL for that asset without checking access rights.
  • If the transform output is reachable, guest users can read content derived from private assets.

Who is impacted:

  • Installations where private source assets can be transformed and transform URLs are reachable.

Security consequence:

  • Anonymous users can obtain content derived from private assets without authentication.

Resources

https://github.com/craftcms/cms/commit/7290d91639e

References