CVE-2026-56394
MEDIUM
6.5
CVSS 3.1
Description
Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.
Metadata
Severity & Metrics
6.5
MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products (1)
| Vendor | Product | Platform | Versions |
|---|---|---|---|
| craftcms | cms | — | 4.0.0-RC1 < 4.17.7, 4.17.7, 5.0.0-RC1 < 5.9.13, 5.9.13 |
Weakness (CWE)
| CWE | Source | Description |
|---|---|---|
| CWE-22 | cna | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
CVSS scores (2)
| Score | Severity | Version | Source | Vector |
|---|---|---|---|---|
| 7.1 | HIGH | 4.0 | cna | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| 6.5 | MEDIUM | 3.1 | cna | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
References (3)
- GHSA Advisory GHSA-c43v-4cr8-6mvp https://github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp
- https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c
- VulnCheck Advisory: Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter https://www.vulncheck.com/advisories/craft-cms-authenticated-path-traversal-in-assets-icon-extension-parameter