CVE-2026-44012— Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
Possible ATT&CK Techniques 1AI
T1083 · File and Directory DiscoveryGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44012
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
Source: NVD (National Vulnerability Database)
Vulnerability Description
Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
Craft CMS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Craft CMS是Craft CMS开源的一套内容管理系统（CMS）。 Craft CMS 5.0.0-RC1至5.9.18之前版本存在安全漏洞，该漏洞源于AssetsController::actionShowInFolder()在获取资产时未检查用户权限，可能导致任何经过身份验证的CP用户枚举资产文件名和完整文件夹结构。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44012
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44012
请登录查看更多情报信息。
- https://github.com/craftcms/cms/security/advisories/GHSA-33m5-hqp9-97pwx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-44012
Same Patch Batch · craftcms · 2026-05-12 · 3 CVEs total
| CVE-2026-44010 | Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclo | |
| CVE-2026-44011 | Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior |
IV. Related Vulnerabilities
Same product: cms
- CVE-2026-44306
Statamic: Email enumeration via forgot password endpoint - CVE-2026-44011
Craft CMS: Potential authenticated Remote Code Execution via - CVE-2026-44010
Craft CMS: Missing Authorization in GraphQL Address Resolver - CVE-2026-7508
Bootstrap CMS Page Creation show.blade.php code injection - CVE-2026-7317
Grav CMS Cache Value FileCache.php doGet deserialization
Same vendor: craftcms
- CVE-2026-44011
Craft CMS: Potential authenticated Remote Code Execution via - CVE-2026-44010
Craft CMS: Missing Authorization in GraphQL Address Resolver - CVE-2026-41130
Craft CMS has a host header injection leading to SSRF via re - CVE-2026-41129
Craft CMS has Server-Side Request Forgery (SSRF) with Asset - CVE-2026-41128
Craft CMS has a Missing Authorization Check on User Group Re
Same weakness: CWE-862
- CVE-2026-33514
Discourse: Information Disclosure in Form Template API Due t - CVE-2026-32312
GLPI: Unauthorized export of form structure - CVE-2026-30950
AutoGPT has Authenticated Session Hijacking via IDOR - CVE-2026-45244
Summarize < 0.15.1 Unapproved Browser Automation Execution - CVE-2026-45242
Summarize < 0.15.1 Path Traversal via slidesDir Parameter
V. Comments for CVE-2026-44012
No comments yet