CVE-2026-56394

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 and later

Description An authenticated path traversal flaw exists in the 'assets/icon' endpoint. The issue occurs because the extension parameter is not validated before the system performs file existence checks. A low-privileged user can provide traversal sequences that resolve to an existing SVG file, bypassing extension enforcement to read unintended local files. This can lead to the disclosure of sensitive configuration data and secrets, such as database credentials and API keys, potentially enabling lateral movement and full site takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.