Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-56394

Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

craftcms cms

Default version status: unaffected

  • 4.0.0-RC1 to < 4.17.7affected
  • 4.17.7unaffected
  • 5.0.0-RC1 to < 5.9.13affected
  • 5.9.13unaffected
pkg:composer/craftcms/cms

References