{"action":"Upgrade craftcms/cms to 4.17.7 or later.","affected":[{"fixed":"4.17.7","introduced":"4.0.0-RC1"},{"fixed":"5.9.13","introduced":"5.0.0-RC1"}],"component":"craftcms/cms","cve_ids":["CVE-2026-56394"],"ecosystem":"Packagist","epss":0.00493,"exploited":false,"fixed_versions":["4.17.7","5.9.13"],"ghsa_id":"GHSA-c43v-4cr8-6mvp","id":"tcs_01M5KF0HPRG9MH5F5QSDGT9TY0","modified_at":"2026-08-06T22:00:56.630374652Z","published_at":"2026-07-09T13:44:06Z","references":["https://osv.dev/vulnerability/GHSA-c43v-4cr8-6mvp","https://github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp","https://nvd.nist.gov/vuln/detail/CVE-2026-56394","https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c","https://github.com/craftcms/cms","https://www.vulncheck.com/advisories/craft-cms-authenticated-path-traversal-in-assets-icon-extension-parameter"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-c43v-4cr8-6mvp","url":"https://osv.dev/vulnerability/GHSA-c43v-4cr8-6mvp"}],"summary":"Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read"}