Craft CMS versions from 5.0.0‑RC1 through before 5.9.18 allow any authenticated control panel user, even one with no volume permissions, to request asset IDs and receive the asset’s filename and the full folder hierarchy of its volume. The vulnerability arises because AssetsController::actionShowInFolder() lacks a viewAssets or viewPeerAssets permission check. The disclosed information includes volume handle, volume UID, folder names, folder UIDs, and folder URI paths, which can aid in covert mapping of the CMS asset structure.

Vendor: CraftCMS; Product: Craft CMS. Affected versions are 5.0.0‑RC1 up to, but not including, 5.9.18.

The CVSS score of 7.1 indicates moderate severity. The vulnerability is limited to authenticated CP users, so an attacker must have valid login credentials to interact with the system. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Additive enumeration of asset identifiers and folder paths can facilitate targeted attacks or reconnaissance, but requires an authenticated session. No further exploitation conditions are reported beyond user permission checks.