Path Traversal in Craftcms Cms
CVE-2026-56394
Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.005 (41.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Craftcms Cms — versions 4.0.0-RC1, 4.17.7, 5.0.0-RC1
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-56394?
- CVE-2026-56394 is a medium-severity vulnerability in Craftcms Cms, classified under Path Traversal. CVSS score: 6.5/10. Published 2026-06-21.
- How severe is CVE-2026-56394?
- Medium severity. CVSS v3 base score is 6.5 out of 10.