Which versions of Craft CMS are affected by CVE-2026-56394?

Craft CMS versions 4.0 through 4.17.6 and 5.0 through 5.9.12 contain an authenticated path traversal vulnerability allowing low-privileged users to read arbitrary SVG files from the server, creating…. A patch is available.

How to fix or mitigate CVE-2026-56394?

Within 24 hours: Identify and audit all Craft CMS installations running versions 4.0.0-RC1 through 4.17.6 or 5.0.0-RC1 through 5.9.12. Within 7 days: Obtain the patched version from the Craft CMS vendor advisory, test in non-production environment, and prepare deployment plan. Within 30 days: Deploy patches to all affected production systems and verify successful upgrade across the entire estate.

Craft CMS CVE-2026-56394

Q: What is the CVSS score of CVE-2026-56394?

CVE-2026-56394 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38160 HIGH

Path Traversal (CWE-22)

2026-06-21 VulnCheck

GHSA-jcmp-jxh2-4jc3

Path Traversal Cms Craftcms

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable assets/icon endpoint exploitable by any authenticated user (PR:L), no user interaction, yields file read (C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 06:08 vuln.today

Analysis Generated

Jun 22, 2026 - 06:08 vuln.today

DescriptionCVE.org

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.

AnalysisAI

Authenticated path traversal in Craft CMS (4.0.0-RC1 through 4.17.6 and 5.0.0-RC1 through 5.9.12) allows low-privileged users to read arbitrary SVG files on the server via the assets/icon endpoint's extension parameter, which was passed to file existence checks without validation. No public exploit identified at time of analysis, though VulnCheck published an advisory and the upstream fix is visible in commit 30f5f1a. Confidentiality impact is high but no integrity or availability impact, and exploitation requires valid authenticated session.

Technical ContextAI

Craft CMS is a PHP-based content management system maintained by Pixel & Tonic. The vulnerability resides in src/helpers/Assets.php within the downloadFile() and iconUrl() helpers, which accepted a user-supplied extension string and used it to construct filesystem paths for icon lookups without sanitization. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) flaw: traversal sequences such as ../../ embedded in the extension parameter resolved against the icon directory, and because the code only verified file existence (not that the resolved path stayed within the intended directory), any reachable SVG file on the host could be returned. The committed fix adds a strict preg_match('/^\w+$/', $extension) check that rejects anything other than alphanumerics and underscores.

RemediationAI

Vendor-released patch: upgrade Craft CMS to 4.17.7 (for the 4.x branch) or 5.9.13 (for the 5.x branch), both of which include commit 30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c that adds strict regex validation of the extension parameter in Assets.php; the advisory at https://github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp documents the fix. If immediate upgrade is not possible, restrict access to the /assets/icon endpoint at the web server or WAF layer by blocking requests whose extension parameter contains anything other than alphanumeric characters (e.g. reject requests matching path-traversal patterns like ../ or %2e%2e), with the trade-off that legitimate icon lookups for unusual extensions may also be rejected. Additionally, audit and prune Craft CMS user accounts to minimise the population that can authenticate, since exploitation requires a valid low-privileged session.