Silverstripe Assets vulnerabilities

CVE-2026-24749 [MEDIUM] CWE-266 Silverstripe Assets Module has a DBFile::getURL() permission bypass Silverstripe Assets Module has a DBFile::getURL() permission bypass ### Impact Images rendered in templates or otherwise accessed via `DBFile::getURL()` or `DBFile::getSourceURL()` incorrectly add an access grant to the current session, which bypasses file permissions. This usually happens when creating an image variant, for example using a manipulation method like `ScaleWidth()` or `Convert()`

CVE-2022-38724 [MEDIUM] CWE-79 CVE-2022-38724: Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverst Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS.

CVE-2022-38147 [MEDIUM] CWE-79 XSS via uploaded gpx file XSS via uploaded gpx file A malicious content author could upload a GPX file with a Javascript payload. The payload could then be executed by luring a legitimate user to view the file in a browser with support for GPX files. GPX is an XML-based format used to store GPS data. By default, Silverstripe CMS will no longer allow GPX files to be uploaded to the assets area.

CVE-2022-29858 [MEDIUM] CWE-287 CVE-2022-29858: Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows p Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content.

CVE-2020-9280 [HIGH] CWE-434 SilverStripe Folders migrated from 3.x may be unsafe to upload to SilverStripe Folders migrated from 3.x may be unsafe to upload to In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is installed and enabled by default on the Com

CVE-2019-12245 [MEDIUM] CWE-732 Lack of access control on upoaded files Lack of access control on upoaded files SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.