CVE-2026-124431Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement

Beschreibung

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all volumes, though not file contents.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-hvp5-pwxx-2752) vendor-advisory
• VulnCheck Advisory: Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement third-party-advisory