{"id":"GHSA-c43v-4cr8-6mvp","title":"Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read","summary":"Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read","severity":"low","cwe":["CWE-22"],"vendor":"craftcms","product":"craftcms/cms","ecosystem":"composer","affected":["craftcms/cms >= 4.0.0-RC1, <= 4.17.6","craftcms/cms >= 5.0.0-RC1, <= 5.9.12"],"patched":["craftcms/cms 4.17.7","craftcms/cms 5.9.13"],"published":"2026-07-09","updated":"2026-07-09","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-c43v-4cr8-6mvp","references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp"},{"url":"https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c"},{"url":"https://github.com/advisories/GHSA-c43v-4cr8-6mvp"}],"tags":["ghsa","composer"],"ingestedAt":"2026-07-09T13:51:05.165Z","slug":"GHSA-c43v-4cr8-6mvp","body":"## Overview\n\n### Summary\n\nAn authenticated path traversal in `assets/icon` allows local SVG file read by passing traversal sequences in the `extension` parameter. The issue is caused by file existence checks happening before extension validation.\n\n### Details\nThe endpoint:\n- `src/controllers/AssetsController.php:1115-1123`\n- `actionIcon(string $extension)` calls `Assets::iconPath($extension)` and returns `sendFile($path, ...)`.\n\nIn `Assets::iconPath()`:\n- Path is built from user-controlled `extension`:\n  - `src/helpers/Assets.php:906-909`\n- If `file_exists($path)` is true, path is returned immediately:\n  - `src/helpers/Assets.php:910-912`\n\nValidation exists in `Assets::iconSvg()`:\n  - `preg_match('/^\\w+$/', $extension)`\n  - `src/helpers/Assets.php:927-931`\n\nHowever, that validation is only reached if `iconPath()` does **not** find a file.\nSo traversal payloads that resolve to existing `.svg` files bypass validation and are served by `sendFile()`.\n\n### Impact\n\n- Authenticated users can read local .svg files accessible to the application process.\n\n### References\n\n- https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c\n\n## Affected packages\n\n- `craftcms/cms >= 4.0.0-RC1, <= 4.17.6`\n- `craftcms/cms >= 5.0.0-RC1, <= 5.9.12`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `craftcms/cms 4.17.7`\n- `craftcms/cms 5.9.13`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}