SB2026081960 - Multiple vulnerabilities in Craft CMS
Published: August 19, 2026 Updated: August 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in AssetsController::actionMoveInfo when handling crafted control panel POST requests with arbitrary folderIds or assetIds. A remote user can send a specially crafted request to disclose sensitive information.
The issue leaks aggregate metadata including asset count and total storage size across folders or volumes the user cannot view, but does not expose file contents or filenames.
2) Code Injection (CVE-ID: N/A)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper control of code generation in field-layout hydration when processing a field-layout tab whose element value is posted as a JSON string. A remote user can submit crafted field-layout element data with behavior or event-handler keys to execute arbitrary code.
No administrative or special permission is required, and exploitation is reachable by any authenticated control-panel user.
3) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper access control in UsersController::actionActivateUser when handling POST requests to users/activate-user. A remote user can submit a crafted request targeting a deactivated administrator account to escalate privileges.
Exploitation requires a control panel account with the administrateUsers permission.
4) Code Injection (CVE-ID: N/A)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper control of code generation in ImageTransforms::normalizeTransform() when handling request-supplied transform data through the element-index endpoint. A remote user can send a specially crafted request that injects a class name and configuration to execute arbitrary code.
Exploitation requires a logged-in non-admin account with access to the control panel and view access to a volume containing at least one asset. The attack uses the admin path and requires specific request parameters for the asset query to reach the vulnerable code path.
Remediation
Install update from vendor's website.