Dashboard / CVE-2026-56394

CVE-2026-56394

HIGH
MEDIUM Priority: 0.04 BB Relevance: 64/100
Published: 2026-06-21 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: None
VA: None

Description

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.

Weakness Classification (1)

References & Advisories (3)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.49%
Raw Score 0.004930
Percentile 42.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00493
2026-10-28
0.00493

Intelligence Sources

nvd ref →

External Links