CVE-2026-124428Medium· 6.5▾ SunlitCraft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or abs…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, to read any SVG-content file readable by the PHP process, including files outside the Craft installation.
cms >= 5.7.0 < 5.11.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56394Medium· 6.5Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter
CVE-2026-72783Medium· 6.2Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class
CVE-2026-56382High· 7.2Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController
CVE-2026-56383Medium· 4.8Craft CMS - Stored XSS in Table Field via Row Heading Column Type
CVE-2026-56385Medium· 4.3Craft CMS - Authorization Bypass in assets/preview-file Endpoint
CVE-2026-56381Medium· 4.8Craft CMS - Stored XSS via User Group Name in User Permissions Page