UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126662

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple

Severity
High 7.1
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Fixed in
5.3.54, 5.7.17, 6.0.6
Weakness
Missing authorization (CWE-862)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Sources
CVE Program

Description

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.

From the CVE Program.

Affected software

SoftwareAffected versions
ContaoServers and applications · cna:contao|contao
  • From 4.0.0 before 5.3.54
  • From 5.4.0-RC1 before 5.7.17
  • From 6.0.0-RC1 before 6.0.6

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126662