Craft CMS versions from 4.0.0-RC1 contain an authenticated path traversal vulnerability in the assets/icon endpoint. This flaw allows an attacker with valid credentials to bypass extension validation by using path traversal sequences, enabling local SVG file read access. The vulnerability has a CVSS score of 6.5, indicating high severity. No patch or remediation details are provided in the available data. There are no known exploits in the wild at this time.