CVE-2026-56394 Details
Description
Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.
A path traversal vulnerability has been identified in Craft CMS versions 4.0.0-RC1 through 4.17.6 and 5.0.0-RC1 through 5.9.12. This vulnerability allows authenticated users to read local SVG files by exploiting the assets/icon endpoint. The issue arises because the extension parameter is not properly validated before the application checks for file existence. Attackers can manipulate the extension parameter with traversal sequences that lead to existing SVG files, bypassing validation and gaining unauthorized access to local files.
Users can update to Craft CMS version 4.17.7 or 5.9.13, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 21, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Craft CMS | >= 4.0.0-RC1, <= 4.17.6 (semver) >= 5.0.0-RC1, <= 5.9.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 21, 2026 | New CVE Received | [email protected] |