Path traversal in Craft CMS - #VU159600
Published: November 6, 2026
Vulnerability identifier: #VU159600
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated control panel user to read SVG content files outside the Craft CMS installation that the PHP process can access.
The vulnerability exists due to unrestricted path and alias resolution in the app/icon-svg endpoint when processing a supplied file path. An authenticated control panel user can post an arbitrary absolute path or alias to retrieve file contents if the file's actual content is SVG.
Affected software
Craft CMS
Remediation
Install security update from vendor's website.
Craft CMS - update to 5.11.2