File and Path Handling

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

1. Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg fi…CVE-2018-3814Craftcms · 1.9% likely

   CWE-434

2. Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTICVE-2024-52293craftcms · CVSS 7.2 · 1.4% likely

   CWE-22

3. Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code ExecutionCVE-2024-52291craftcms · CVSS 8.5 · 1.3% likely

   CWE-22

4. Craft Allows Attackers to Read Arbitrary System FilesCVE-2024-52292craftcms · CVSS 7.7 · 0.7% likely

   CWE-552

5. Craft CMS - Authenticated Path Traversal in assets/icon Extension ParameterCVE-2026-56394craftcms · CVSS 6.5 · 0.5% likely

   CWE-22

6. Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svgCVE-2026-124428craftcms · CVSS 6.5 · 0.3% likely

   CWE-22

7. Craft CMS has a Path Traversal Vulnerability in AssetsControllerCVE-2026-32262craftcms · CVSS 5.3 · 0.3% likely

   CWE-22

8. Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContainedCVE-2026-72783craftcms · CVSS 6.2 · 0.2% likely

   CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.