GHSA-c43v-4cr8-6mvp: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
(updated )
An authenticated path traversal in assets/icon allows local SVG file read by passing traversal sequences in the extension parameter. The issue is caused by file existence checks happening before extension validation.
References
- github.com/advisories/GHSA-c43v-4cr8-6mvp
- github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c
- github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp
- nvd.nist.gov/vuln/detail/CVE-2026-56394
- www.vulncheck.com/advisories/craft-cms-authenticated-path-traversal-in-assets-icon-extension-parameter
Code Behaviors & Features
Detect and mitigate GHSA-c43v-4cr8-6mvp with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →