Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.5, published 21 June 2026.

Which products and versions are affected?

craftcms/cms (Packagist) >= 4.0.0-RC1, <= 4.17.6.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Craft CMS path traversal in assets/icon endpoint

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected?

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 6.5 · Published 2026-06-21

Craft CMS, a popular content management system, contains a security flaw in how it handles requests for file icons. An authenticated user can exploit this to read sensitive SVG files from the server's local storage that they should not have access to. This could lead to the exposure of internal system information or configuration data stored in SVG format.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.5, published 21 June 2026.
Which products and versions are affected?: craftcms/cms (Packagist) >= 4.0.0-RC1, <= 4.17.6.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a network appliance.
Am I affected?: Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated path traversal vulnerability exists in the `assets/icon` endpoint of Craft CMS. The root cause is that the application performs file existence checks using the user-supplied `extension` parameter before validating its format. By providing a path traversal sequence (e.g., `../../`) in the extension parameter that resolves to an existing `.svg` file on the local filesystem, an attacker can bypass the subsequent regex validation. This allows an authenticated attacker with low privileges to read arbitrary SVG files accessible to the web server process. The issue is fixed in versions 4.17.7 and 5.9.13.

Affected products

Craft CMS Craft CMS >= 4.0.0-RC1, < 4.17.7; >= 5.0.0-RC1, < 5.9.13

Timeline

2026-06-02: advisory: Original GHSA-c43v-4cr8-6mvp published
2026-06-21: disclosed: CVE-2026-56394 published
2026-08-06: other: Duplicate advisory GHSA-jcmp-jxh2-4jc3 withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.