CVE-2026-56394

描述

### Summary An authenticated path traversal in `assets/icon` allows local SVG file read by passing traversal sequences in the `extension` parameter. The issue is caused by file existence checks happening before extension validation. ### Details The endpoint: - `src/controllers/AssetsController.php:1115-1123` - `actionIcon(string $extension)` calls `Assets::iconPath($extension)` and returns `sendFile($path, ...)`. In `Assets::iconPath()`: - Path is built from user-controlled `extension`: - `src/helpers/Assets.php:906-909` - If `file_exists($path)` is true, path is returned immediately: - `src/helpers/Assets.php:910-912` Validation exists in `Assets::iconSvg()`: - `preg_match('/^\w+$/', $extension)` - `src/helpers/Assets.php:927-931` However, that validation is only reached if `iconPath()` does **not** find a file. So traversal payloads that resolve to existing `.svg` files bypass validation and are served by `sendFile()`. ### Impact - Authenticated users can read local .svg files accessible to the application process. ### References - https://github.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c

如何修補 CVE-2026-56394

要修補 CVE-2026-56394,請將受影響套件升級到下列已修補版本。

• —升級至 4.17.7 或更新版本

CVE-2026-56394 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 4.0.0-RC1, < 4.17.7

CVSS 分數

參考連結(3)

• PATCHgithub.com/craftcms/cms
• WEBgithub.com/craftcms/cms/commit/30f5f1a8d6edf0f3a00be72c42c78d9dc7d72d5c
• WEBgithub.com/craftcms/cms/security/advisories/GHSA-c43v-4cr8-6mvp