Access Control Flaw in Silverstripe Framework Assets Module

CVE-2026-24749

What is CVE-2026-24749?

The Silverstripe Assets Module contains an access control flaw that allows unauthorized access to files. In versions prior to 2.4.5 and from 3.0.0-rc1 to 3.1.2, images rendered in templates or accessed through certain methods mistakenly grant access to the current session, bypassing intended file permissions. This vulnerability primarily arises when image variants are created, leading to potential exposure of protected files if they are configured with 'protected' visibility without specific access grants. Developers are advised to update to the fixed versions 2.4.5 and 3.1.3 to remediate this issue.

References