What is GHSA-53vf-c43h-j2x9?

GHSA-53vf-c43h-j2x9 is a security advisory published by GitHub Security Advisories with Medium severity. Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Which CVE IDs does GHSA-53vf-c43h-j2x9 cover?

GHSA-53vf-c43h-j2x9 covers the following CVE IDs: CVE-2025-68436. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-53vf-c43h-j2x9?

GHSA-53vf-c43h-j2x9 affects 2 products, including: composer/craftcms/cms:\u003e= 5.0.0-RC1, \u003c= 5.8.20; composer/craftcms/cms:\u003e= 4.0.0-RC1, \u003c= 4.16.16.

GHSA-53vf-c43h-j2x9Medium

Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Vendor

GitHub Security Advisories

Published

January 5, 2026

Last Modified

January 6, 2026

🔗 CVE IDs covered (1)

CVE-2025-68436 →

📋 Description

Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Resources:

https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9

🎯 Affected products2

composer/craftcms/cms:>= 5.0.0-RC1, <= 5.8.20
composer/craftcms/cms:>= 4.0.0-RC1, <= 4.16.16

🔗 References (4)

https://github.com/craftcms/cms/security/advisories/GHSA-53vf-c43h-j2x9
https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9
https://nvd.nist.gov/vuln/detail/CVE-2025-68436
https://github.com/advisories/GHSA-53vf-c43h-j2x9