Craft CMS EUVD-2026-38160

Attacker must hold valid authenticated credentials for the Craft CMS instance (PR:L - any logged-in user role that can reach the assets/icon controller is sufficient; no admin role required), and the target file must be an existing SVG file reachable on the filesystem from the icon directory via relative traversal. Limiting factors: the read primitive is constrained to files whose paths resolve through the icon-lookup logic as SVGs, not arbitrary file types; the target must be running an affected 4.0.0-RC1-4.17.6 or 5.0.0-RC1-5.9.12 release; and the attacker needs network reachability to the CMS control panel or asset endpoints, which are often behind authentication gateways or VPNs in hardened deployments.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H reflects a network-reachable, low-complexity bug that requires only a low-privileged authenticated session and yields high confidentiality impact (file read) but no integrity or availability impact - the 7.1 score is consistent with a meaningful but bounded exposure. The vendor classifies it as low-severity in their own advisory language, and the read primitive is limited to files that exist as SVG-resolvable paths on disk, which constrains what an attacker can actually exfiltrate compared with an arbitrary-file-read primitive. EPSS and KEV data were not provided, so widespread exploitation probability is unknown, but no public exploit identified at time of analysis and the requirement for an authenticated CMS account makes opportunistic mass exploitation unlikely. Priority should be elevated for multi-tenant Craft installations where untrusted users hold accounts, and routine for single-tenant deployments where all authenticated users are already trusted.

An attacker with any authenticated Craft CMS account (for example a low-privileged content author on a multi-tenant site) sends a request to assets/icon with an extension parameter containing traversal sequences pointing at an SVG file outside the intended icon directory, such as one stored in the application or webroot. The server resolves the path, confirms the file exists, and returns its contents, giving the attacker read access to that SVG. No public PoC is published, but the upstream patch diff makes the exploitable code path and required payload shape obvious to anyone reviewing the commit.