CVE-2026-56394CWE-22

Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter

High · published June 21, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00493 · 41.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-21T13:27Z
EPSS history
Timeline
  • 21 JUN 13:27Z
    Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter
    cvelistv5