What’s Vulnerable › Vulnerabilities

CVE-2022-29858

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-28 · updated 2026-06-17
• Weakness: CWE-287

Description

Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content.

Affected products

• silverstripe Assets: before 1.10.1 — fixed in 1.10.1

How to fix

Upgrade to a fixed version: silverstripe Assets 1.10.1. Check the vendor advisory for mitigations.

References

• https://forum.silverstripe.org/c/releases
• https://github.com/silverstripe/silverstripe-assets/commit/5f6a73b010c01587ffbfb954441f6b7cbb54e767
• https://huntr.dev/bounties/90e17d95-9f2f-44eb-9f26-49fa13a41d5a/
• https://www.silverstripe.org/blog/tag/release
• https://www.silverstripe.org/download/security-releases/
• https://www.silverstripe.org/download/security-releases/cve-2022-29858
• https://forum.silverstripe.org/c/releases
• https://github.com/silverstripe/silverstripe-assets/commit/5f6a73b010c01587ffbfb954441f6b7cbb54e767
• https://huntr.dev/bounties/90e17d95-9f2f-44eb-9f26-49fa13a41d5a/
• https://www.silverstripe.org/blog/tag/release
• https://www.silverstripe.org/download/security-releases/
• https://www.silverstripe.org/download/security-releases/cve-2022-29858

Get alerted when CVE-2022-29858 or the next vulnerability affects your stack