Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

silverstripe/assets

6 known vulnerabilities (3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 3 medium
Registry
Packagist

Advisories 6

  • CVE-2026-24749Medium 5.3

    Silverstripe Assets Module has a DBFile::getURL() permission bypass

    Affected: fixed in 2.4.5; from 3.0.0, fixed in 3.1.3.

  • CVE-2022-38147Medium 5.4

    Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).

    Affected: from 1.0.0, fixed in 1.11.1.

  • CVE-2022-38724Medium 5.4

    Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow…

    Affected: from 1.0.0, fixed in 1.11.1.

  • Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by…

    Affected: from 1.0.0, fixed in 1.10.1.

  • In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads"…

    Affected: from 1.0.0, fixed in 1.4.7; from 1.5.0, fixed in 1.5.2.

  • SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile().

    Affected: from 1.0.0, fixed in 1.3.5; from 1.4.0, fixed in 1.4.4.