Threats tagged 'ghsa-cx42-qq9h-8hhg'

Craft CMS versions from 5.7.0 up to but not including 5.11.2 contain an arbitrary file read vulnerability. Authenticated control panel users can exploit this flaw by sending crafted requests to the app/icon-svg endpoint to read SVG files via arbitrary paths. The vulnerability allows reading any SVG-content file accessible by the PHP process, including files outside the Craft installation directory.