Executive brief
Craft CMS, a popular content management system, contains a security flaw that allows logged-in users to view sensitive internal files. By manipulating specific web requests, an attacker can bypass security checks to read SVG files stored on the server that they should not have access to. This could lead to the exposure of system information or private assets. Users should update to the latest patched versions to resolve this issue.
Technical details
A path traversal vulnerability exists in the `assets/icon` endpoint of Craft CMS. The root cause is located in `Assets::iconPath()`, where a file existence check (`file_exists`) is performed on a path constructed from the user-supplied `extension` parameter before any input validation occurs. If a file exists at the traversed path, the application returns it immediately via `sendFile()`, bypassing the regex validation in `Assets::iconSvg()`. An authenticated attacker can exploit this by providing traversal sequences (e.g., `../../`) in the `extension` parameter to read arbitrary `.svg` files accessible to the web server process. The issue is fixed in versions 4.17.7 and 5.9.13.
Affected products
- Pixel & Tonic Craft CMS >= 4.0.0-RC1, <= 4.17.6; >= 5.0.0-RC1, <= 5.9.12
Timeline
- 2026-06-02: disclosed: Initial disclosure by reporter
- 2026-07-09: advisory: GitHub Advisory published
- 2026-07-09: patched: Fixes released in versions 4.17.7 and 5.9.13