---
id: "CVE-2026-124428"
page: "https://infrastack.ai/live/CVE-2026-124428"
kind: "vulnerability"
aliases: ["CVE-2026-124428"]
title: "Craft CMS: control panel users can read arbitrary SVG files on the server"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["craft-cms", "package", "php", "self-hosted"]
not_affected_if: ["trusted-admins-only", "version-outside-range"]
published_at: "2026-11-08T14:18:08+00:00"
first_seen_at: "2026-11-08T14:48:38+00:00"
updated_at: "2026-11-08T14:49:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124428", "first_seen_at": "2026-11-08T14:48:38+00:00"}]
exploit_sources: []
---

# Craft CMS: control panel users can read arbitrary SVG files on the server

Link for people: https://infrastack.ai/live/CVE-2026-124428 (this .md is for agents)

Craft CMS from 5.7.0 before 5.11.2 lets an authenticated control panel user post arbitrary paths to the app/icon-svg endpoint and read SVG files. Attackers can use absolute paths or aliases that bypass permission checks, reading any SVG-content file the PHP process can access, including files outside the Craft installation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Craft CMS version in `composer.json` or with `composer show craftcms/cms`; affected releases are 5.7.0 up to but not including 5.11.2.
- Confirm whether control panel users are untrusted or the panel is exposed to the internet.

## Fix

- Craft CMS: upgrade to `5.11.2` or later.

## Timeline

- 2026-11-08T14:48:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124428

## Documents

- [advisory] Vendor advisory: github.com https://github.com/craftcms/cms/security/advisories/GHSA-5v62-pcq7-fxj9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/craft-cms-5.7.0-before-5.11.2-arbitrary-svg-file-read-via-app-icon-svg

## From the sources

Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, to read any SVG-content file readable by the PHP process, including files outside the Craft installation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_