Craft CMS starting from version 4.0.0-RC1 has an authenticated path traversal vulnerability (CWE-22) in the assets/icon endpoint. The vulnerability arises because the extension parameter is not properly validated before file existence checks. Attackers with authentication can exploit this by supplying traversal sequences that resolve to existing local SVG files, thereby reading local files. This issue is tracked as GHSA-jcmp-jxh2-4jc3 and has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The advisory is a duplicate of GHSA-c43v-4cr8-6mvp and no patch or fix information is provided in the input data.

An authenticated attacker can read local SVG files on the server by exploiting the path traversal vulnerability in the assets/icon endpoint. This can lead to unauthorized disclosure of sensitive local files. The vulnerability does not allow code execution or denial of service based on the provided data. The impact is limited to confidentiality (high impact) with no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the vendor's security advisories for updates. Until a fix is available, restrict authenticated user permissions to minimize exposure and avoid uploading or storing sensitive SVG files accessible via the vulnerable endpoint.