CVE-2026-114548

Name of the Vulnerable Software and Affected Versions ImageAPI Optimize WebP versions 0.0.0 through 2.1.2

Description Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. The module serves WebP image derivative responses with the Cache-Control: public HTTP header for all file schemes except the private file system, including temporary file systems and access-controlled custom schemes. This behavior can result in users receiving cached versions of files containing information they are not authorized to access, particularly when using a shared cache like Varnish or a CDN that honors the Cache-Control header. Exploitation requires the site to serve image derivatives from a custom or temporary file scheme with access control behind such a cache, and the attacker must know the path of a previously requested file remaining in the cache.

Recommendations Update ImageAPI Optimize WebP to a version later than 2.1.2.