Fixed GHSA-5pgf-h923-m958

Author: brandonkelly

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## Unreleased
 
 - The `PDO::MYSQL_ATTR_MULTI_STATEMENTS` attribute is no longer set by default for database connections. ([#18474](https://github.com/craftcms/cms/issues/18474))
+- Fixed a [low-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) information disclosure vulnerability. (GHSA-5pgf-h923-m958)
 
 ## 4.17.7 - 2026-02-24
 

src/controllers/AssetsController.php

@@ -1194,6 +1194,9 @@ public function actionPreviewFile(): Response
             return $this->asFailure(Craft::t('app', 'Asset not found with that id'));
         }
 
+        $this->requireVolumePermissionByAsset('viewAssets', $asset);
+        $this->requirePeerVolumePermissionByAsset('viewPeerAssets', $asset);
+
         $previewHtml = null;
 
         $previewHandler = Craft::$app->getAssets()->getAssetPreviewHandler($asset);