CVE-2026-56394 is an authenticated path traversal vulnerability affecting Craft CMS starting from version 4.0.0-RC1 through 5.0.0-RC1. The issue exists in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers with authenticated access can exploit this by supplying path traversal sequences that resolve to existing SVG files, thereby gaining unauthorized local file read access. The vulnerability has a CVSS 4.0 score of 7.1 (high severity). No vendor advisory or patch information is currently available.

An authenticated attacker can read arbitrary local files on the server by exploiting the path traversal vulnerability in the assets/icon endpoint. This can lead to unauthorized disclosure of sensitive information stored on the server. The vulnerability does not require user interaction beyond authentication and has a high severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoints to trusted users only and monitor for suspicious activity involving path traversal patterns in requests. Avoid exposing the vulnerable endpoint to untrusted networks.