GHSA-5pgf-h923-m958 Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

• Packagist craftcms/cms: >= 5.0.0-RC1, < 5.9.14 → fixed in 5.9.14 • Packagist craftcms/cms: >= 4.0.0-RC1, < 4.17.8 → fixed in 4.17.8

Summary An unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. Details Root cause: • Anonymous endpoint accepts user-controlled asset reference. • It creates and returns a transform URL for that asset without checking access rights. • If the transform output is reachable, guest users can read content derived from private assets. Who is impacted: • Installations where private source assets can be transformed and transform URLs are reachable. Security consequence: • Anonymous users can obtain content derived from private assets without authentication. Resources https://github.com/craftcms/cms/commit/7290d91639e