CVE-2026-107844
MediumCVSS 5.3Summary
Contao, an Open Source CMS, versions 5.0.0 through 5.3.50 and 5.7.12, has a vulnerability in ImagesController that joins the user-controlled {path} parameter to the image target directory without verifying the canonical path stays within that directory. An unauthenticated attacker can use encoded parent-directory segments to access files under the project directory if their extensions are allowed. This issue is fixed in versions 5.3.50 and 5.7.12.
Risk Assessment
The risk is unauthorized reading of files from the project directory, potentially exposing sensitive data. Additionally, the route can reveal path existence and absolute filesystem paths in debug responses.
Recommendation
Immediately upgrade Contao to version 5.3.50 or 5.7.12, which contain the fix. Also, check for any unauthorized file access.
Other vulnerabilities in Contao
See all- CVE-2026-107851Medium
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12.
- CVE-2026-107850Medium
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.
- CVE-2026-107848Low
Contao from version 4.0.0 to 5.3.50 and 5.7.12 has a CSRF vulnerability because RequestTokenListener validates the token only for POST requests, and the GET guard runs only when an act parameter is present. Backend actions via the key parameter can execute without a CSRF token when an authenticated user loads a malicious URL. Fixed in versions 5.3.50 and 5.7.12.
- CVE-2026-107843Medium
Contao, an Open Source CMS, versions 4.1.0 through 5.3.50 and 5.7.12, has a vulnerability in ModuleRegistration::compile() that allows the follow-up registration branch to be entered on any POST to a page with the registration module without verifying FORM_SUBMIT or the captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to send repeated activation emails and determine if a pending registration exists. This issue is fixed in versions 5.3.50 and 5.7.12.
- CVE-2026-107842Medium
Contao, an Open Source CMS, versions 4.0.0 through 5.3.50 and 5.7.12, has a vulnerability in ModuleSearch that can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. This issue is fixed in versions 5.3.50 and 5.7.12.
- CVE-2017-10993High
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, known as Directory Traversal.
- CVE-2026-107845Critical
In versions from 4.0.0 until 5.3.50 and 5.7.12, Contao (an Open Source CMS) renders comment email or website metadata without sufficient attribute and URL encoding in listComments(). An unauthenticated visitor can submit a comment with malicious script that executes in the backend context when a user opens the Comments module. This issue is fixed in versions 5.3.50 and 5.7.12.
- CVE-2026-55825Low
Contao CMS versions 5.7.0 through 5.7.6 contain a cross-job authorization bypass vulnerability. An authenticated backend user can read attachments from other jobs by manipulating the attachment identifier with '../' sequences.
- CVE-2026-57232Low
Contao CMS versions 5.3.35 through 5.3.47 and 5.7.0-RC1 through 5.7.8 contain an SSRF vulnerability in the Feed Reader module. A backend user with module-edit permissions can make the server request internal network services, loopback addresses, or cloud metadata endpoints.
- CVE-2026-55824Low
Contao CMS versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6 contain a credential leakage vulnerability via the crawler. The crawler improperly cleans authentication options, potentially sending credentials to external hosts.
Original NVD description (English source)
Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBasePath() to verify that the canonical path remains inside that directory. An unauthenticated request containing encoded parent-directory segments can therefore return files under the project directory through BinaryFileResponse when their names use an extension allowed by contao.image.valid_extensions. The route can also reveal whether arbitrary paths exist, and debug responses can disclose absolute filesystem paths, but paths below the upload directory were not shown to be readable. This issue is fixed in versions 5.3.50 and 5.7.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS