Craft CMS contains an authenticated path traversal vulnerability in the assets/icon endpoint. The vulnerability is due to the order of operations in the code: the file existence check on a user-controlled extension parameter occurs before validating that the extension matches a safe pattern. If the file exists, it is served immediately without validation, allowing traversal payloads to read arbitrary local .svg files. This affects authenticated users who can supply crafted extension parameters to access local SVG files.

Authenticated users can read local .svg files accessible to the application process, potentially exposing sensitive information contained within those files. The vulnerability does not allow remote unauthenticated access or code execution, and the severity is assessed as low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious activity related to file access. Avoid exposing sensitive SVG files on the server.