PT-2026-51235 · Craft Cms · Cms

Gcxwlp · Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-56394

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-56394

Affected Products

Cms

References · 4

• https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56394 · Security Note
• https://vulncheck.com/advisories/craft-cms-authenticated-path-traversal-in-assets-icon-extension-parameter · Note