{"id":"CVE-2026-124428","kind":"vulnerability","aliases":["CVE-2026-124428"],"related":[],"title":"Craft CMS: control panel users can read arbitrary SVG files on the server","description":"Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, to read any SVG-content file readable by the PHP process, including files outside the Craft installation.","summary":"Craft CMS from 5.7.0 before 5.11.2 lets an authenticated control panel user post arbitrary paths to the app/icon-svg endpoint and read SVG files. Attackers can use absolute paths or aliases that bypass permission checks, reading any SVG-content file the PHP process can access, including files outside the Craft installation.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","package","php","self-hosted"],"not_affected_if":["trusted-admins-only","version-outside-range"],"how_to_check":"- Check the Craft CMS version in `composer.json` or with `composer show craftcms/cms`; affected releases are 5.7.0 up to but not including 5.11.2.\n- Confirm whether control panel users are untrusted or the panel is exposed to the internet.","fix":"- Craft CMS: upgrade to `5.11.2` or later.","status":"open","published_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:49:54+00:00","updated_at":"2026-11-08T14:49:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-08T14:49:54Z","model":"claude-haiku-5-5","output":{"fix":"- Craft CMS: upgrade to `5.11.2` or later.","reach":"internet","title":"Craft CMS: control panel users can read arbitrary SVG files on the server","impact":"medium","summary":"Craft CMS from 5.7.0 before 5.11.2 lets an authenticated control panel user post arbitrary paths to the app/icon-svg endpoint and read SVG files. Attackers can use absolute paths or aliases that bypass permission checks, reading any SVG-content file the PHP process can access, including files outside the Craft installation.","audience":"businesses","category":"package","nicknames":[],"who_cares":["craft-cms","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"control panel user reads server files outside the install","analyst_note":"","how_to_check":"- Check the Craft CMS version in `composer.json` or with `composer show craftcms/cms`; affected releases are 5.7.0 up to but not including 5.11.2.\n- Confirm whether control panel users are untrusted or the panel is exposed to the internet.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-range","trusted-admins-only"],"who_is_affected":"Sites running Craft CMS 5.7.0 through 5.10.x where control panel users are not fully trusted. Only authenticated control panel accounts can use the flaw, so sites with a single trusted editor carry lower risk. Sites on versions before 5.7.0 or 5.11.2 and later are not in the stated range.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4635,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124428':16A,19A '-2026':15A,18A '5.11.2':33B,84C '5.7.0':31B,82C 'absolut':54B,114C 'access':72B 'alias':57B,112C 'allow':92C 'app/icon-svg':45B,107C 'arbitrari':8A,41B,87C,103C 'attack':51B,109C 'authent':36B,93C 'bypass':59B 'check':61B,121C 'cms':2A,22B,29B,80C 'contain':85C 'content':66B,127C 'control':3A,37B,94C 'craft':1A,21B,28B,77B,79C,138C 'craft-cm':20B 'cve':14A,17A 'endpoint':46B,108C 'file':10A,50B,67B,74B,88C,100C,128C,135C 'host':27B 'includ':73B,134C 'instal':78B,139C 'let':34B 'outsid':75B,136C 'packag':23B 'panel':4A,38B,95C 'path':42B,55B,104C,115C 'permiss':60B,120C 'php':24B,69B,132C 'post':40B,102C 'process':70B,133C 'read':7A,48B,62B,89C,98C,123C 'readabl':129C 'resolv':118C 'self':26B 'self-host':25B 'server':13A 'suppli':111C 'svg':9A,49B,65B,99C,126C 'svg-content':64B,125C 'use':53B 'user':5A,39B,96C 'vulner':90C 'without':119C","nicknames":[],"mitigations":[],"who_affected":"Sites running Craft CMS 5.7.0 through 5.10.x where control panel users are not fully trusted. Only authenticated control panel accounts can use the flaw, so sites with a single trusted editor carry lower risk. Sites on versions before 5.7.0 or 5.11.2 and later are not in the stated range.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["craftcms","high","package","php","selfhosted"],"campaign_type":null,"search_a":"'-124428':16A,19A '-2026':15A,18A 'arbitrari':8A 'cms':2A 'control':3A 'craft':1A 'cve':14A,17A 'file':10A 'panel':4A 'read':7A 'server':13A 'svg':9A 'user':5A","search_b":"'5.11.2':33B '5.7.0':31B 'absolut':54B 'access':72B 'alias':57B 'app/icon-svg':45B 'arbitrari':41B 'attack':51B 'authent':36B 'bypass':59B 'check':61B 'cms':22B,29B 'content':66B 'control':37B 'craft':21B,28B,77B 'craft-cm':20B 'endpoint':46B 'file':50B,67B,74B 'host':27B 'includ':73B 'instal':78B 'let':34B 'outsid':75B 'packag':23B 'panel':38B 'path':42B,55B 'permiss':60B 'php':24B,69B 'post':40B 'process':70B 'read':48B,62B 'self':26B 'self-host':25B 'svg':49B,65B 'svg-content':64B 'use':53B 'user':39B","search_c":"'5.11.2':84C '5.7.0':82C 'absolut':114C 'alias':112C 'allow':92C 'app/icon-svg':107C 'arbitrari':87C,103C 'attack':109C 'authent':93C 'check':121C 'cms':80C 'contain':85C 'content':127C 'control':94C 'craft':79C,138C 'endpoint':108C 'file':88C,100C,128C,135C 'includ':134C 'instal':139C 'outsid':136C 'panel':95C 'path':104C,115C 'permiss':120C 'php':132C 'post':102C 'process':133C 'read':89C,98C,123C 'readabl':129C 'resolv':118C 'suppli':111C 'svg':99C,126C 'svg-content':125C 'user':96C 'vulner':90C 'without':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T09:13:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124428","severity":null,"published_at":"2026-11-08T14:18:08+00:00","modified_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null}],"documents":[{"id":102040,"url":"https://github.com/craftcms/cms/security/advisories/GHSA-5v62-pcq7-fxj9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T09:13:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102041,"url":"https://www.vulncheck.com/advisories/craft-cms-5.7.0-before-5.11.2-arbitrary-svg-file-read-via-app-icon-svg","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}