CVE-2026-56394: Craft CMS Path Traversal Vulnerability

CVE-2026-56394 Overview

CVE-2026-56394 is an authenticated path traversal vulnerability in Craft CMS starting from version 4.0.0-RC1. The flaw resides in the assets/icon endpoint, where the extension parameter is passed to file existence checks without validation. Authenticated attackers can supply traversal sequences that resolve to existing SVG files on the host filesystem. Successful exploitation grants local file read access through the icon resolution logic. The issue is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact

Authenticated attackers can read arbitrary SVG files outside the intended assets directory by abusing the unvalidated extension parameter in assets/icon.

Affected Products

• Craft CMS versions from 4.0.0-RC1 onward (prior to the patched release)
• Installations exposing the assets/icon action to authenticated users
• Deployments relying on iconUrl() in src/helpers/Assets.php without the upstream fix

Discovery Timeline

• 2026-06-21 - CVE-2026-56394 published to the National Vulnerability Database (NVD)
• 2026-06-23 - CVE-2026-56394 last updated in NVD

Technical Details for CVE-2026-56394

Vulnerability Analysis

The vulnerability exists in the Craft CMS assets/icon controller action, which serves icon images based on a user-supplied file extension. The iconUrl() helper in src/helpers/Assets.php accepts an extension string and forwards it into URL action building without character validation. Downstream code performs a file existence check using the attacker-controlled value, allowing path traversal sequences such as ../ to escape the icon directory. When the resolved path points to an existing SVG file, the contents are returned to the requester. Authentication is required, lowering the practical attack surface but not eliminating risk in multi-tenant or low-trust user environments.

Root Cause

The root cause is missing input validation on the extension parameter. Craft CMS treated the value as a trusted file extension string, while the code path performed filesystem lookups with it. Without a regex restricting allowed characters, traversal payloads passed through and reached file resolution logic.

Attack Vector

Exploitation requires network access to the Craft CMS application and a valid authenticated session with permission to invoke the assets/icon action. The attacker submits a crafted extension query parameter containing traversal sequences that resolve to an SVG file outside the intended directory. The server then reads and returns the file contents.

// Patch from src/helpers/Assets.php (GHSA-c43v-4cr8-6mvp)
 */
public static function iconUrl(string $extension): string
{
    if (!preg_match('/^\w+$/', $extension)) {
        throw new InvalidArgumentException("$extension isn't a valid file extension.");
    }

    return UrlHelper::actionUrl('assets/icon', [
        'extension' => $extension,
    ]);
}

Source: craftcms/cms commit 30f5f1a

The fix enforces a strict ^\w+$ regex, rejecting any extension containing slashes, dots, or other non-word characters before the value is used.

Detection Methods for CVE-2026-56394

Indicators of Compromise

• Web access log entries to /index.php?p=actions/assets/icon or /actions/assets/icon with an extension parameter containing .., /, \, or URL-encoded equivalents (%2e%2e, %2f)
• HTTP 200 responses to assets/icon requests with unusually large response bodies or unexpected SVG content
• Authenticated sessions issuing repeated assets/icon calls with varying traversal depths

Detection Strategies

• Inspect Craft CMS web server and application logs for assets/icon requests whose extension parameter fails an ^\w+$ character check.
• Deploy a Web Application Firewall (WAF) rule that blocks traversal sequences in the extension query parameter for the assets/icon route.
• Correlate authenticated user activity with anomalous file read patterns originating from the Craft CMS process.

Monitoring Recommendations

• Alert on Craft CMS instances still running unpatched 4.x or later releases prior to the fix in commit 30f5f1a.
• Track outbound size and frequency anomalies on the assets/icon endpoint per authenticated user.
• Monitor filesystem access by the PHP worker process for reads outside the configured Craft assets directory.

How to Mitigate CVE-2026-56394

Immediate Actions Required

• Upgrade Craft CMS to the patched release referenced in GHSA-c43v-4cr8-6mvp.
• Audit authenticated user accounts and revoke unused or low-trust credentials that can reach the assets/icon endpoint.
• Review access logs for prior exploitation attempts containing traversal sequences in the extension parameter.

Patch Information

The fix is committed in craftcms/cms commit 30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c. It adds a preg_match('/^\w+$/', $extension) validation in Assets::iconUrl() and throws InvalidArgumentException on invalid input. Additional context is available in the VulnCheck advisory.

Workarounds

• Restrict access to the Craft CMS control panel and authenticated endpoints to trusted networks via VPN or IP allow-listing.
• Add a WAF or reverse proxy rule rejecting requests to assets/icon when extension contains characters outside [A-Za-z0-9_].
• Apply least-privilege filesystem permissions to the PHP worker so it cannot read files outside the web root and assets directories.

# Example nginx rule to block traversal in the extension parameter
location ~* /actions/assets/icon {
    if ($arg_extension ~* "[^A-Za-z0-9_]") {
        return 400;
    }
}