CVE-2026-124428
Received Received - Intake

Arbitrary File Read in Craft CMS via SVG Path Manipulation

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, to read any SVG-content file readable by the PHP process, including files outside the Craft installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124428
EUVD
EUVD-2026-119572

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms craft_cms From 5.7.0 (inc) to 5.11.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-124428 is an arbitrary file read vulnerability in Craft CMS versions 5.7.0 to 5.11.1. Authenticated control panel users can exploit the app/icon-svg endpoint to read SVG files by supplying arbitrary paths, including aliases or absolute paths. The endpoint lacks proper permission checks beyond requiring a logged-in session, allowing access to any SVG-content file readable by the PHP process, even outside the Craft installation directory.

Detection Guidance

To detect this vulnerability, monitor access to the app/icon-svg endpoint in Craft CMS logs. Check for unusual file reads or requests with arbitrary paths. Use network traffic analysis tools like Wireshark or tcpdump to inspect HTTP requests targeting this endpoint. Verify if any control panel users are attempting to read files outside the expected directories.

Impact Analysis

This vulnerability allows attackers with control panel access to read sensitive SVG files on the server, potentially exposing confidential data. While non-SVG files like PHP or configuration files cannot be read directly, any file with valid SVG content is accessible if the PHP process has read permissions. This could lead to information disclosure or further exploitation if sensitive data is stored in SVG files.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data stored in SVG files. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized file access may result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade Craft CMS to version 5.11.2 or later to patch the vulnerability. If upgrading is not possible, restrict access to the control panel by IP or implement additional authentication layers. Review and revoke unnecessary permissions for control panel users. Monitor for any suspicious activity related to file reads via the app/icon-svg endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...