Executive brief
Craft CMS, a popular content management system, contains a security flaw that allows any user with access to the control panel to view sensitive file and folder information. Even users with no specific permissions to view files can discover filenames and the complete internal folder structure of the website's storage volumes. This could lead to the exposure of private document names or confidential media structures, which could be used to facilitate further targeted attacks.
Technical details
A missing authorization check exists in the AssetsController::actionShowInFolder() method of Craft CMS. The application fetches assets by ID and returns their filename and complete folder hierarchy (including volume handles, UIDs, and URI paths) without verifying if the requesting user has 'viewAssets' or 'viewPeerAssets' permissions. An authenticated attacker with access to the Control Panel can exploit this by supplying arbitrary asset IDs to enumerate the full directory structure and filenames across all storage volumes. This vulnerability was addressed in version 5.9.18 by implementing proper volume permission checks.
Affected products
- Pixel & Tonic Craft CMS 5.0.0-RC1 to 5.9.17
Timeline
- 2026-04-27: disclosed: Security advisory published on GitHub
- 2026-05-12: advisory: CVE-2026-44012 published to NVD
- 2026-05-12: patched: Fix released in version 5.9.18