# silverstripe/assets (Packagist) vulnerabilities

6 known vulnerabilities (3 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/silverstripe/assets

## Advisories (6)

### [CVE-2026-24749](https://cve.now/CVE-2026-24749): Silverstripe Assets Module has a DBFile::getURL() permission bypass

- Severity: Medium 5.3
- Published: Apr 16, 2026
- Affected: fixed in 2.4.5; from 3.0.0, fixed in 3.1.3.

### [CVE-2022-38147](https://cve.now/CVE-2022-38147): Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).

- Severity: Medium 5.4
- Published: Nov 23, 2022
- Affected: from 1.0.0, fixed in 1.11.1.

### [CVE-2022-38724](https://cve.now/CVE-2022-38724): Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow…

- Severity: Medium 5.4
- Published: Nov 22, 2022
- Affected: from 1.0.0, fixed in 1.11.1.

### [CVE-2022-29858](https://cve.now/CVE-2022-29858): Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by…

- Severity: Unrated
- Published: Jun 28, 2022
- Affected: from 1.0.0, fixed in 1.10.1.

### [CVE-2020-9280](https://cve.now/CVE-2020-9280): In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads"…

- Severity: Unrated
- Published: Apr 15, 2020
- Affected: from 1.0.0, fixed in 1.4.7; from 1.5.0, fixed in 1.5.2.

### [CVE-2019-12245](https://cve.now/CVE-2019-12245): SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile().

- Severity: Unrated
- Published: Sep 25, 2019
- Affected: from 1.0.0, fixed in 1.3.5; from 1.4.0, fixed in 1.4.4.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/silverstripe/assets
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.