CVE-2026-124428 Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124428?
CVE-2026-124428 is a high-severity vulnerability in craftcms cms, published on 8 Nov 2026.
Official description
Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, to read any SVG-content file readable by the PHP process, including files outside the Craft installation.
Weakness: CWE-22
Which versions are affected by CVE-2026-124428?
How do I fix CVE-2026-124428?
No fix has been published for CVE-2026-124428 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124428 being exploited?
There is no known exploitation of CVE-2026-124428 in the wild and no public exploit code.
Sources
Also known as GHSA-5v62-pcq7-fxj9, GHSA-cx42-qq9h-8hhg.