Vulnerability · Published Jun 21, 2026 · Assigned by VulnCheck

CVE-2026-56394Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter

Medium 6.5

In plain English

A medium-severity path traversal in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 57.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	craftcms/cms	4.17.7	GHSA-c43v-4cr8-6mvp
Packagist	craftcms/cms	5.9.13	GHSA-c43v-4cr8-6mvp

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	4.0.0-RC1 – before 4.17.75.0.0-RC1 – before 5.9.13

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GHSA Advisory GHSA-c43v-4cr8-6mvp vendor-advisory
https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c patch
VulnCheck Advisory: Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter third-party-advisory