Listen to this Post
The vulnerability in Craft CMS involves an information disclosure issue due to unchecked asset relocation during user profile photo updates. Authenticated users can craft malicious requests to manipulate the asset source path, potentially accessing sensitive files outside intended directories. When a user uploads a profile photo, the system relocates the asset from a temporary location to persistent storage. However, insufficient validation allows attackers to specify arbitrary paths via parameters, enabling directory traversal. For example, by injecting sequences like “../../../”, an attacker can reference files such as configuration files, environment data, or database credentials. The application may then attempt to relocate these files, exposing their contents or making them accessible via web routes. This exploitation requires authenticated access, meaning the attacker must have a user account on the Craft CMS instance. The vulnerability stems from the lack of sanitization on user-provided input for asset paths before relocation operations. In affected versions, the code does not restrict the source path to safe directories within asset volumes or upload areas. This allows malicious users to bypass access controls and read arbitrary files from the server, depending on file permissions and server configuration. The severity is moderate because it requires authentication and may be limited by server-side restrictions. The patch adds validation to ensure that source paths are within allowed boundaries, preventing path manipulation attacks. Code changes include checking for directory traversal sequences and verifying that paths reside within designated asset volumes. This mitigates the risk by ensuring that only files from intended locations are relocated during profile photo updates.
Platform: Craft CMS
Version: 4.0.0-4.16.16 5.0.0-5.8.20
Vulnerability: Information disclosure asset
Severity: Moderate
date: Jan 3 2026
Prediction: Patched Jan 5 2026
What Undercode Say:
Analytics:
Showing bash commands and codes related to the blog
how Exploit:
Protection from this CVE
Impact:
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
