5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24749

CVE-2026-24749: Silverstripe Assets Module has a DBFile::getURL() permission bypass

The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2, images rendered in templates or otherwise accessed via DBFile::getURL() or DBFile::getSourceURL() incorrectly add an access grant to the current session, which bypasses file permissions. This usually happens when creating an image variant, for example using a manipulation method like ScaleWidth() or Convert(). Note that if developers use DBFile directly in the $db configuration for a DataObject class that doesn't subclass File, and if they were setting the visibility of those files to "protected", those files will now need an explicit access grant to be accessed. If developers do not want to explicitly provide access grants for these files in their apps (i.e. they want these files to be accessible by default), they should use the "public" visibility. This issue has been fixed in versions 2.4.5 and 3.1.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24749

CVE-2026-24749:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
silverstripe/assets	composer	< 2.4.5	2.4.5
silverstripe/assets	composer	>= 3.0.0, < 3.1.3	3.1.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the default behavior of several getURL and getSourceURL methods within the silverstripe/silverstripe-assets module. These methods had a default parameter $grant = true, which caused an access grant to be automatically added to the current user's session whenever a URL for a file was generated. This bypassed the intended permission model, allowing unauthorized access to protected files. The vulnerability is particularly exposed when image variants are created (e.g., using ScaleWidth() or Convert()), as these operations implicitly call the vulnerable getURL method.

The patch addresses this by changing the default parameter to $grant = false across all relevant methods, including the core implementation in SilverStripe\Assets\Storage\DBFile and the corresponding abstract/interface definitions in SilverStripe\Assets\ImageManipulation and SilverStripe\Assets\Storage\AssetContainer. Now, access must be explicitly granted by calling getURL(true), making the default behavior secure. The analysis of the patch commits clearly shows this change as the primary mitigation. An attacker could have exploited this by requesting an image or file, which would trigger a call to getURL() in the backend, granting them access to a protected resource.

Vulnerable functions

SilverStripe\Assets\Storage\DBFile::getURL

src/Storage/DBFile.php

The `getURL` function in `DBFile` had a default parameter `$grant = true`. This means that any call to this function without explicitly setting `$grant` to `false` would grant access to the file for the current session, bypassing permission checks. This is the core of the vulnerability.

SilverStripe\Assets\Storage\DBFile::getSourceURL

src/Storage/DBFile.php

Similar to `getURL`, the `getSourceURL` function in `DBFile` also had a default parameter `$grant = true`, leading to the same permission bypass vulnerability.

SilverStripe\Assets\Folder::getURL

src/Folder.php

The default parameter of `getURL` in the `Folder` class was changed from `$grant = true` to `$grant = false`. Although this specific implementation returns `null`, the change is part of the security patch to ensure consistent behavior across the API and prevent potential misuse in subclasses or future implementations.

SilverStripe\Assets\ImageManipulation::getURL

src/ImageManipulation.php

This is an abstract method, and the patch changes the default value of the `$grant` parameter in its signature. This enforces the secure default (`$grant = false`) on all concrete implementations of this method, which are responsible for generating URLs for manipulated images. The vulnerability description explicitly mentions image manipulations like `ScaleWidth()` as a common attack vector.

SilverStripe\Assets\Storage\AssetContainer::getURL

src/Storage/AssetContainer.php

This is an interface method, and the patch changes the default value of the `$grant` parameter in its signature. This ensures that all classes implementing the `AssetContainer` interface adhere to the new secure default of not granting access when generating a URL. `DBFile` is an implementation of this interface.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.