CVE-2026-124428 · Package
NO FIX YET · SEE WHAT TO DO
Craft CMS from 5.7.0 before 5.11.2 lets an authenticated control panel user post arbitrary paths to the app/icon-svg endpoint and read SVG files. Attackers can use absolute paths or aliases that bypass permission checks, reading any SVG-content file the PHP process can access, including files outside the Craft installation.
first public Oct 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Craft CMS 5.7.0 through 5.10.x where control panel users are not fully trusted. Only authenticated control panel accounts can use the flaw, so sites with a single trusted editor carry lower risk. Sites on versions before 5.7.0 or 5.11.2 and later are not in the stated range.
Not affected if trusted-admins-only, version-outside-range
Who cares craft-cms, php, self-hosted
composer.json or with composer show craftcms/cms; affected releases are 5.7.0 up to but not including 5.11.2.5.11.2 or later.Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, to read any SVG-content file readable by the PHP process, including files outside the Craft installation.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.