CVE-2026-124431Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement

Açıklama

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all volumes, though not file contents.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-hvp5-pwxx-2752) vendor-advisory
• VulnCheck Advisory: Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement third-party-advisory