Vulnerability Description
Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c
- https://github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp
- https://www.vulncheck.com/advisories/craft-cms-authenticated-path-traversal-in-a
FAQ
What is CVE-2026-56394?
CVE-2026-56394 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can b...
How severe is CVE-2026-56394?
CVE-2026-56394 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56394?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.