GHSA-5v62-pcq7-fxj9: 
PHP vulnerability analysis and mitigation

A control panel user can read the contents of any file on the server whose content sniffs as image/svg+xml, including files outside the Craft installation, by posting an arbitrary path to the app/icon-svg endpoint. The endpoint has no permission check beyond being logged into the control panel, and the helper it calls resolves aliases and absolute paths before reading the file. The only effective guard is FileHelper::isSvg(), which sniffs the file’s actual content: arbitrary PHP, config, or env files are refused because their content is not SVG. That constrains the read to files whose bytes genuinely parse as SVG, but those files can live anywhere on the filesystem that the PHP process can read. This family has history: GHSA-472v-j2g4-g9h2 added charset guards to Assets::iconUrl and iconPath, and GHSA-c43v-4cr8-6mvp fixed traversal in AssetsController::actionIcon. Both of those guards sit on the helpers/Assets.php code paths.

Impact

Any control panel user can read any SVG content file anywhere on the filesystem that the PHP process can read. Report ID: 1922