{"action":"Upgrade silverstripe/assets to 2.4.5 or later.","affected":[{"fixed":"2.4.5","introduced":"0"},{"fixed":"3.1.3","introduced":"3.0.0"}],"component":"silverstripe/assets","cve_ids":["CVE-2026-24749"],"ecosystem":"Packagist","epss":0.00398,"exploited":false,"fixed_versions":["2.4.5","3.1.3"],"ghsa_id":"GHSA-jgcf-rf45-2f8v","id":"tcs_01M5KF4J9M2HEWCVFJWE68S5HZ","modified_at":"2026-05-05T16:09:18.686537Z","published_at":"2026-04-16T20:40:37Z","references":["https://osv.dev/vulnerability/GHSA-jgcf-rf45-2f8v","https://github.com/silverstripe/silverstripe-assets/security/advisories/GHSA-jgcf-rf45-2f8v","https://nvd.nist.gov/vuln/detail/CVE-2026-24749","https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2026-24749.yaml","https://github.com/silverstripe/silverstripe-assets","https://www.silverstripe.org/download/security-releases/cve-2026-24749"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-jgcf-rf45-2f8v","url":"https://osv.dev/vulnerability/GHSA-jgcf-rf45-2f8v"}],"summary":"Silverstripe Assets Module has a DBFile::getURL() permission bypass"}