---
id: CVE-2026-56394
title: Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter
summary: >-
  Craft CMS from 4.0.0-RC1 contains an authenticated path traversal
  vulnerability in the assets/icon endpoint where the extension parameter is not
  validated before file existence checks. Attackers can bypass extension
  validation by passing…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: craftcms
product: cms
affected:
  - cms >= 4.0.0-RC1 < 4.17.7
  - cms >= 5.0.0-RC1 < 5.9.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-23T13:34:08.737226Z'
published: '2026-06-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:11.968Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56394'
references:
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp'
    label: GitHub Security Advisory (GHSA-c43v-4cr8-6mvp)
  - url: >-
      https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c
    label: >-
      https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c
  - url: >-
      https://www.vulncheck.com/advisories/craft-cms-authenticated-path-traversal-in-assets-icon-extension-parameter
    label: >-
      VulnCheck Advisory: Craft CMS - Authenticated Path Traversal in
      assets/icon Extension Parameter
tags:
  - cve.org
epss: 0.00493
epssPercentile: 0.42644
ingestedAt: '2026-11-08T14:51:22.348Z'
---

## Overview

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.

## Affected

- `cms >= 4.0.0-RC1 < 4.17.7`
- `cms >= 5.0.0-RC1 < 5.9.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.