CVE-2026-33160: Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL
Summary
An unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes.
The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL.
Details
Root cause: - Anonymous endpoint accepts user-controlled asset reference. - It creates and returns a transform URL for that asset without checking access rights. - If the transform output is reachable, guest users can read content derived from private assets.
Who is impacted:
- Installations where private source assets can be transformed and transform URLs are reachable.
Security consequence:
- Anonymous users can obtain content derived from private assets without authentication.
Resources
https://github.com/craftcms/cms/commit/7290d91639e
Other sources
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. This issue has been patched in versions 4.17.8 and 5.9.14.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33160?
CVE-2026-33160 has a high severity due to its potential to expose private assets to unauthorized users.
How do I fix CVE-2026-33160?
To fix CVE-2026-33160, upgrade Craft CMS to version 4.17.8 or 5.9.14.
What type of vulnerability is CVE-2026-33160?
CVE-2026-33160 is an access control vulnerability affecting asset transformations.
Who is affected by CVE-2026-33160?
CVE-2026-33160 affects users of Craft CMS versions between 4.0.0-RC1 and 4.17.7, and between 5.0.0-RC1 and 5.9.13.
What is the attack vector for CVE-2026-33160?
The attack vector for CVE-2026-33160 allows unauthenticated users to exploit the anonymous endpoint 'assets/generate-transform' to access private asset URLs.