CVE-2026-56394: Craft CMS Authenticated Path Traversal in Assets Icon Endpoint

Technical summary

CVE-2026-56394 is an authenticated path traversal vulnerability in Craft CMS affecting the assets/icon endpoint. The vulnerability exists because the extension parameter is validated after file existence checks rather than before, and the validation itself can be bypassed using directory traversal sequences (e.g., ../) that resolve to legitimate SVG files. An attacker with valid authentication credentials can craft requests that traverse the filesystem to read arbitrary SVG files, circumventing the intended file access restrictions. The flaw is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Business impact

This vulnerability impacts the confidentiality of files accessible to the Craft CMS application process. While the attack requires valid authentication credentials, the impact is significant because an authenticated user—potentially a contributor, editor, or compromised low-privilege account—could exfiltrate sensitive configuration files, template data, or other SVG resources that contain business-critical or personally identifiable information. Organizations relying on role-based access controls in Craft CMS should recognize that this flaw can bypass those controls for file read operations, potentially exposing data that should be restricted to administrators only.

Affected systems

Craft CMS versions 4.0.0-RC1 and later are affected. The vendor data provided does not specify an upper bound or patched version; verify the official Craft CMS security advisory and release notes for the exact affected version range and the specific patch version that resolves this issue.

Exploitability

Exploitation requires valid Craft CMS authentication credentials and network access to the affected application. An attacker cannot exploit this remotely without first obtaining legitimate user credentials. The attack itself is relatively straightforward once authenticated—an attacker simply crafts a malicious request to the assets/icon endpoint with a path traversal sequence in the extension parameter. The lack of a public exploit and absence from the CISA Known Exploited Vulnerabilities (KEV) catalog suggests the flaw was not widely exploited in the wild prior to disclosure.

Remediation

Patch to the latest version of Craft CMS that addresses CVE-2026-56394. Verify the specific patch version number in the official Craft CMS security advisory and apply updates to all affected instances. As an interim control, restrict network access to the assets/icon endpoint to trusted users only and monitor authentication logs for suspicious activity patterns. Consider implementing Web Application Firewall rules to detect and block requests containing path traversal sequences targeting that endpoint.

Patch guidance

Consult the official Craft CMS security advisory to identify the patched version number for this CVE. Once identified, apply the patch through your normal update process. Test the patch in a non-production environment first to ensure compatibility with your custom plugins and templates. If you maintain Craft CMS on a custom deployment, monitor the Craft CMS GitHub repository and security announcements for release schedules.

Detection guidance

Monitor web server and Craft CMS application logs for requests to the /assets/icon endpoint that contain unusual path traversal sequences (../, ..\, URL-encoded variants like %2e%2e%2f, or double-encoded sequences). Correlate these requests with authentication logs to identify which users are making these attempts. Implement alerting for any SVG file read operations by non-admin users outside of normal application workflows. Network-based intrusion detection can flag requests with path traversal patterns in the extension parameter.

Why prioritize this

Although this vulnerability carries a MEDIUM severity score (6.5 CVSS), it merits prompt patching because it undermines file access controls in an authenticated context. Many organizations extend Craft CMS permissions to multiple user roles beyond administrators. A compromised mid-level account or a malicious insider could exploit this to exfiltrate sensitive configuration, template metadata, or user-related SVG files. The attack requires authentication, which limits the immediate blast radius, but the confidentiality impact is high relative to the effort required. Prioritize patching in environments where multiple users have Craft CMS access.

Risk score, explained

The CVSS 3.1 base score of 6.5 (MEDIUM) reflects a network-accessible vulnerability with low attack complexity that requires authentication (PR:L) and results in high confidentiality impact (C:H) with no integrity or availability impact. The score appropriately captures that this is a read-only, information-disclosure attack that depends on the attacker already having valid credentials. Organizations should evaluate their specific risk by considering the sensitivity of files stored alongside Craft CMS, the number of authenticated users, and whether any users have a history of suspicious activity.

Frequently asked questions