CVE-2026-44012

Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

Published May 12, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18.

Analysis

Technical impact

Craft CMS versions from 5.0.0‑RC1 through before 5.9.18 allow any authenticated control panel user, even one with no volume permissions, to request asset IDs and receive the asset’s filename and the full folder hierarchy of its volume. The vulnerability arises because AssetsController::actionShowInFolder() lacks a viewAssets or viewPeerAssets permission check. The disclosed information includes volume handle, volume UID, folder names, folder UIDs, and folder URI paths, which can aid in covert mapping of the CMS asset structure.

Affected Systems

Vendor: CraftCMS; Product: Craft CMS. Affected versions are 5.0.0‑RC1 up to, but not including, 5.9.18.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate severity. The vulnerability is limited to authenticated CP users, so an attacker must have valid login credentials to interact with the system. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Additive enumeration of asset identifiers and folder paths can facilitate targeted attacks or reconnaissance, but requires an authenticated session. No further exploitation conditions are reported beyond user permission checks.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

craftcms

cms

affected

Version	Status	Constraints
`>= 5.0.0-RC1, < 5.9.18`	affected	—

No data.

Vendor Product Versions

Craftcms

Version	Status	Scheme	Platform
`[5.0.0-RC1,5.9.18)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Craft CMS to version 5.9.18 or later, which removes the missing permission check.
If an upgrade is delayed, remove or minimize viewAssets and viewPeerAssets permissions for all CP users to prevent enumeration of untrusted volumes.
Continuously monitor CP access logs for anomalous asset enumeration activity and audit user privilege assignments.

Generated by OpenCVE AI on May 12, 2026 at 22:42 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-33m5-hqp9-97pw	Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.337% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/craftcms/cms/commit/e3f3eaab3d85badd713cfc2c24e5f0792ecdb586
https://github.com/craftcms/cms/security/advisories/GHSA-33m5-hqp9-97pw

History

May 13, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 13, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Craftcms Craftcms craftcms
Vendors & Products		Craftcms Craftcms craftcms

May 12, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18.
Title		Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
Weaknesses		CWE-862
References		https://github.com/craftcms/cms/commit/e3f3eaab3d85badd713cfc2c24e5f0792ecdb586 https://github.com/craftcms/cms/security/advisories/GHSA-33m5-hqp9-97pw
Metrics		cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`