Executive brief
Craft CMS, a popular content management system, contains a security flaw in how it handles requests for file icons. An authenticated user can exploit this to read sensitive SVG files from the server's local storage that they should not have access to. This could lead to the exposure of internal system information or configuration data stored in SVG format.
Technical details
An authenticated path traversal vulnerability exists in the `assets/icon` endpoint of Craft CMS. The root cause is that the application performs file existence checks using the user-supplied `extension` parameter before validating its format. By providing a path traversal sequence (e.g., `../../`) in the extension parameter that resolves to an existing `.svg` file on the local filesystem, an attacker can bypass the subsequent regex validation. This allows an authenticated attacker with low privileges to read arbitrary SVG files accessible to the web server process. The issue is fixed in versions 4.17.7 and 5.9.13.
Affected products
- Craft CMS Craft CMS >= 4.0.0-RC1, < 4.17.7; >= 5.0.0-RC1, < 5.9.13
Timeline
- 2026-06-02: advisory: Original GHSA-c43v-4cr8-6mvp published
- 2026-06-21: disclosed: CVE-2026-56394 published
- 2026-08-06: other: Duplicate advisory GHSA-jcmp-jxh2-4jc3 withdrawn