[LOW] Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

PKSA-5x6f-x35f-73db CVE-2026-56394 GHSA-c43v-4cr8-6mvp

Affected package: craftcms/cms

Affected version: >=5.0.0-RC1,<=5.9.12|>=4.0.0-RC1,<=4.17.6

Reported by:
GitHub