GitHub Advisoryadvisory · Packagist

GHSA-53vf-c43h-j2x9 Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

MEDIUM Published 2026-01-05 Modified 2026-01-06 Official page ↗

Aliases: CVE-2025-68436
Ecosystem: Packagist
Packages: craftcms/cms
Severity: Moderate
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses: CWE-200
Reviewed: 2026-01-05

Affected packages

• Packagist craftcms/cms: >= 5.0.0-RC1, < 5.8.21 → fixed in 5.8.21 • Packagist craftcms/cms: >= 4.0.0-RC1, < 4.16.17 → fixed in 4.16.17

Description

Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Resources: https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9 https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9

Related

Alias · CVE (1)

CVE-2025-68436 Craft is a platform for creating digital experiences. vulnerability

Weakness · CWE (1)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References