CVE-2025-68436

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68436
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68436.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-68436
Aliases
Published
2026-01-05T21:46:01.734Z
Modified
2026-07-15T01:48:55.830819359Z
Severity
  • 4.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
Details

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68436.json",
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
e3456380bdf7b18a5bb4c47c2e61e62805960915
Fixed
b5f17cd3246cf10034a914464964757b0b84bcd3
Introduced
856f45f2766b1a1df5db437b5cd3fe5cce896b5b
Fixed
8582f04f8346c6cf285a18d9704c4a2d9371e9bf
Introduced
982efcd14d7e93a1a54f0905b61f242de6b53d8a
Fixed
4bcb0db554e273b66ce3b75263a13414c2368fc9
Database specific 
{
    "cpe": [
        "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*",
        "cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "4.0.0.1"
        },
        {
            "fixed": "4.16.17"
        },
        {
            "introduced": "5.0.1"
        },
        {
            "fixed": "5.8.21"
        },
        {
            "introduced": "4.0.0-NA"
        },
        {
            "last_affected": "4.0.0-NA"
        },
        {
            "introduced": "4.0.0-rc1"
        },
        {
            "last_affected": "4.0.0-rc1"
        },
        {
            "introduced": "4.0.0-rc2"
        },
        {
            "last_affected": "4.0.0-rc2"
        },
        {
            "introduced": "4.0.0-rc3"
        },
        {
            "last_affected": "4.0.0-rc3"
        },
        {
            "introduced": "5.0.0-NA"
        },
        {
            "last_affected": "5.0.0-NA"
        },
        {
            "introduced": "5.0.0-rc1"
        },
        {
            "last_affected": "5.0.0-rc1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/nystudio107/craft-seomatic
Events
Introduced
a31f7d211b52d55d274c66a291310ceec64c733f
Last affected
a31f7d211b52d55d274c66a291310ceec64c733f
Database specific 
{
    "cpe": "cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.0.0-NA"
        },
        {
            "last_affected": "4.0.0-NA"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

4.*
4.0.0
4.0.0-NA
4.0.0-rc1
4.0.0-rc2
4.0.0-rc3
5.*
5.0.0-NA
5.0.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68436.json"