CVE-2025-68436: 
PHP vulnerability analysis and mitigation

CVE-2025-68436 is an information disclosure vulnerability in Craft CMS, described as "Potential information disclosure via unchecked asset relocation." Authenticated users can exploit maliciously crafted requests via the user profile photo feature to expose sensitive assets they should not have access to. It affects Craft CMS versions 4.0.0-RC1 through 4.16.16 and 5.0.0-RC1 through 5.8.20. The vulnerability was published on January 3, 2026, with patched versions released the same day. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 4.9 (Medium) (Github Advisory, Craft CMS Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), specifically an unchecked asset relocation issue in the User.php element handler. The fix reveals the mechanism: the photoId attribute was included in the list of "safe attributes" that could be mass-assigned via user-controlled input, allowing authenticated users to craft requests that relocate or reference arbitrary asset IDs as their profile photo, thereby exposing assets outside their authorization scope. The patch (commit 4bcb0db) resolves this by overriding the safeAttributes() method in src/elements/User.php to explicitly exclude photoId from mass-assignable attributes (Craft CMS Commit, Craft CMS Advisory). The vulnerability is exploitable over the network with low privileges and requires no user interaction.

Successful exploitation allows an authenticated attacker to access and retrieve sensitive assets stored in the Craft CMS installation that they are not authorized to view. The impact is limited to confidentiality — there is no integrity or availability impact. While lateral movement is not directly enabled, exposure of sensitive files (e.g., private documents, restricted media) could facilitate further attacks or data exfiltration (Github Advisory, Craft CMS Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.039% (12th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid authentication credentials, which limits the attack surface compared to unauthenticated vulnerabilities (Github Advisory).

1. Authenticate: Obtain valid credentials for any user account on the target Craft CMS installation (versions 4.0.0-RC1 through 4.16.16 or 5.0.0-RC1 through 5.8.20).
2. Identify target assets: Enumerate or guess asset IDs within the Craft CMS installation that belong to restricted volumes or entries not accessible to the attacker's account.
3. Craft malicious request: Submit a crafted HTTP request to the user profile update endpoint, including a photoId parameter set to the ID of a sensitive asset the attacker wishes to access — exploiting the lack of authorization checks on mass-assigned attributes.
4. Retrieve exposed asset: After the request is processed, access the user profile photo URL, which now references the targeted sensitive asset, effectively bypassing access controls and exposing its contents (Craft CMS Advisory, Craft CMS Commit).

• Logs: Craft CMS access logs showing authenticated POST requests to user profile update endpoints with unusual or unexpected photoId parameter values; repeated requests cycling through sequential or non-sequential asset IDs from a single authenticated user.
• Application Behavior: User profile photos resolving to assets from restricted volumes or entries unrelated to the user's own uploads.
• Network: HTTP requests to profile photo URLs returning content inconsistent with expected user-uploaded images (e.g., documents, private media files).

Craft CMS has released patched versions addressing this vulnerability: 4.16.17 for the 4.x branch and 5.8.21 for the 5.x branch. Administrators should update immediately using Composer (composer update craftcms/cms). As an interim measure pending patching, audit access logs for suspicious profile update requests and consider restricting authenticated access to the control panel where feasible (Craft CMS Advisory, Github Advisory).

The vulnerability was reported by security researcher z3rco and disclosed responsibly through GitHub's security advisory process. The advisory was published by Craft CMS maintainer angrybrad on January 3, 2026. No significant broader media coverage or notable community commentary beyond the standard advisory publication has been identified (Craft CMS Advisory).