CVE-2026-56394: Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter
Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Perform server-side validation of the 'extension' parameter in the /actions/assets/icon handler before any file existence checks. Reject values containing '../', '..\\', leading '/' or '\\', or percent-encoded traversal sequences (e.g. %2e%2e). Only accept a tight whitelist of extension strings such as 'svg'.
Craft CMS assets/icon endpoint extension parameter validation = reject path traversal sequences and only allow expected extension tokens (e.g., svg) - Compensating control
Configure a web application firewall or reverse proxy rule to block requests to the /actions/assets/icon endpoint that contain path traversal patterns (e.g. '../' or percent-encoded equivalents like %2e%2e) or other suspicious path normalization sequences. Normalize incoming URLs before inspection to detect encoded traversal.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56394?
CVE-2026-56394 has a medium severity rating of 6.5.
How do I fix CVE-2026-56394?
To fix CVE-2026-56394, ensure that the extension parameter in the assets/icon endpoint is properly validated before conducting file existence checks.
What is the impact of CVE-2026-56394?
CVE-2026-56394 allows authenticated attackers to exploit path traversal vulnerabilities, potentially accessing unauthorized SVG files.
Which versions of Craft CMS are affected by CVE-2026-56394?
Craft CMS starting from version 4.0.0-RC1 is affected by CVE-2026-56394.
What type of vulnerability is CVE-2026-56394 classified as?
CVE-2026-56394 is classified as a path traversal vulnerability.