CVE-2026-55825
CVE-2026-55825 · Contao: Possible path traversal in job download URIs
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. The later attachment lookup joins that authorized job UUID with the attacker-controlled identifier, then passes the combined path to the virtual filesystem. VirtualFilesystem::resolve() canonicalizes the whole path and only rejects paths that escape the filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes victim-job/debug_log.csv. This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values.
CVSS 3.1 · Low · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
contao
- Versions
- >= 5.7.0, < 5.7.7: Affected
No fix published
contao/contao Packagist
- Versions
- 5.7.0
- 5.7.1
- 5.7.2
- 5.7.3
- 5.7.4
- 5.7.5
- 5.7.6
- Affected ranges
- ECOSYSTEM: ≥ 5.7.0, < 5.7.7
Update to 5.7.7
contao/core-bundle Packagist
- Versions
- 5.7.0
- 5.7.1
- 5.7.2
- 5.7.3
- 5.7.4
- 5.7.5
- 5.7.6
- Affected ranges
- ECOSYSTEM: ≥ 5.7.0, < 5.7.7
Update to 5.7.7