CVE-2026-124428: Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg

Published Nov 8, 2026

Updated

Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, to read any SVG-content file readable by the PHP process, including files outside the Craft installation.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Craft CMS to a version that resolves this vulnerability.
Fixed in 5.11.2

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated Craft CMS control panel account. The issue is reachable over the network and does not require user interaction.

What files can be exposed?

The attacker can read files containing SVG content that are readable by the PHP process. This can include SVG files outside the Craft installation when an absolute path or alias resolves to them.

Are all affected Craft CMS 5 installations vulnerable by default?

The provided information identifies affected versions as 5.7.0 before 5.11.2, but does not state whether any additional configuration is required. Exposure depends on authenticated control panel access and which SVG-content files the PHP process can read.

How can I determine whether an instance may already have been targeted?

Review requests to the app/icon-svg endpoint for submitted aliases or absolute filesystem paths, especially paths outside the Craft installation. The supplied data does not identify specific log fields or indicators beyond use of that endpoint.

CVE-2026-124428: Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What files can be exposed?

Are all affected Craft CMS 5 installations vulnerable by default?

How can I determine whether an instance may already have been targeted?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What files can be exposed?

Are all affected Craft CMS 5 installations vulnerable by default?

How can I determine whether an instance may already have been targeted?