CVE-2026-33161— Craft CMS 安全漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-33161の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users
ソース: NVD (National Vulnerability Database)
脆弱性説明
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response data, including focalPoint. The endpoint returns private editing metadata without per-asset authorization validation. This issue has been patched in versions 4.17.8 and 5.9.14.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
信息暴露
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Craft CMS 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Craft CMS是Craft CMS开源的一套内容管理系统（CMS）。 Craft CMS 4.17.8之前版本和5.9.14之前版本存在安全漏洞，该漏洞源于未进行按资源授权验证，可能导致未经授权访问私有资产的编辑元数据。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-33161の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-33161のインテリジェンス情報
请登录查看更多情报信息。
- Release 5.9.14 · craftcms/cms · GitHubx_refsource_MISC
- Release 4.17.8 · craftcms/cms · GitHubx_refsource_MISC
- Fixed GHSA-5pgf-h923-m958 · craftcms/cms@d30df31 · GitHubx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-33161
Same Patch Batch · craftcms · 2026-03-24 · 6 CVEs total
| CVE-2026-33160 | Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via t | |
| CVE-2026-33162 | Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to | |
| CVE-2026-33157 | Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior | |
| CVE-2026-33158 | Craft CMS: Low-privilege users could read private asset contents when editing an asset (ID | |
| CVE-2026-33159 | Craft CMS: Unauthenticated users could execute project configuration sync operations that |
IV. 関連脆弱性
同じ製品: cms
- CVE-2026-7508
Bootstrap CMS Page Creation show.blade.php code injection - CVE-2026-7317
Grav CMS Cache Value FileCache.php doGet deserialization - CVE-2026-7016
MaxSite CMS ushki Plugin cross site scripting - CVE-2026-7015
MaxSite CMS Guestbook Plugin cross site scripting - CVE-2026-7014
MaxSite CMS down_count Plugin cross site scripting
同じベンダー: craftcms
- CVE-2026-41130
Craft CMS has a host header injection leading to SSRF via re - CVE-2026-41129
Craft CMS has Server-Side Request Forgery (SSRF) with Asset - CVE-2026-41128
Craft CMS has a Missing Authorization Check on User Group Re - CVE-2026-32272
Craft Commerce: Blind SQL Injection via hasVariant/hasProduc - CVE-2026-32271
Craft Commerce: SQL Injection can lead to Remote Code Execut
同じ弱点: CWE-200
- CVE-2026-42333
quarkus-openapi-generator has overly broad path-parameter ma - CVE-2026-8198
Activity Logs, User Activity Tracking, Multisite Activity Lo - CVE-2026-42456
AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (ID - CVE-2026-41520
Cillium exposes sensitive information included in the cilium - CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cro
V. CVE-2026-33161へのコメント
まだコメントはありません