From dd2cd25e3272ff14cb43e64989d93bbff00e8230 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Joachim=20R=C3=BCtter?= <me@mynetx.net>
Date: Thu, 29 Jan 2026 22:43:20 +0000
Subject: [PATCH] Abort 404 when asset is not found in AssetsController

Add null guard after Asset::find() in show() and download() methods
to return a 404 instead of a 500 error when the asset doesn't exist.

Fixes #13739
---
 src/Http/Controllers/CP/Assets/AssetsController.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/Http/Controllers/CP/Assets/AssetsController.php b/src/Http/Controllers/CP/Assets/AssetsController.php
index 60ea736109..83460f08ec 100644
--- a/src/Http/Controllers/CP/Assets/AssetsController.php
+++ b/src/Http/Controllers/CP/Assets/AssetsController.php
@@ -42,6 +42,8 @@ public function show($asset)
     {
         $asset = Asset::find(base64_decode($asset));
 
+        abort_if(! $asset, 404);
+
         // TODO: Auth
 
         return new AssetResource($asset);
@@ -132,6 +134,8 @@ public function download($asset)
     {
         $asset = Asset::find(base64_decode($asset));
 
+        abort_if(! $asset, 404);
+
         // TODO: Auth
 
         return $asset->download();