CVE-2026-44012
HighSummary
Craft CMS prior to version 5.9.18 has a vulnerability in AssetsController::actionShowInFolder() that allows fetching the filename and full folder hierarchy of an asset without checking user permissions. Any authenticated CP user, even without volume permissions, can enumerate asset filenames and folder structures.
Risk Assessment
This vulnerability may lead to the exposure of sensitive information about assets and folder structures, posing a risk to data security within the organization.
Recommendation
It is recommended to update Craft CMS to version 5.9.18 or later to mitigate this vulnerability and implement appropriate access controls for assets.
Other vulnerabilities in Craft CMS
See all- CVE-2026-72784Medium
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.
- CVE-2026-72781High
Craft CMS versions from 5.0.0-RC1 before 5.10.7 and from 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism, allowing an authenticated attacker with control panel access to execute arbitrary code.
- CVE-2026-72779Medium
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.
- CVE-2026-31266High
Craft CMS version 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate).
- CVE-2026-44011High
Craft CMS contains an input-handling flaw that allows authenticated users to inject malicious configuration and execute arbitrary commands on the server. The issue affects versions from 4.0.0 to before 4.17.12 and 5.9.18.
- CVE-2026-44010High
Craft CMS has a vulnerability that allows low-privilege users to read address data. The issue stems from a lack of schema scope filtering in GraphQL queries, enabling access to personal data of users from other groups.
- CVE-2025-68455High
Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to authenticated Remote Code Execution via a maliciously attached Behavior. The attack requires administrator access to the Craft Control Panel.
- CVE-2025-68454High
Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to authenticated Remote Code Execution via Twig SSTI. The vulnerability requires administrator access to the Control Panel with allowAdminChanges enabled, or a non-admin account with access to the System Messages utility. A malicious payload using the Twig `map` filter in Twig-accepting text fields can lead to RCE.
- CVE-2025-68456Critical
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.
- CVE-2026-79988High
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.
Original NVD description (English source)
Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18.