UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126663

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag

Severity
Medium 5.3
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Fixed in
5.3.54, 5.7.17, 6.0.6
Weakness
CWE-180
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Sources
CVE Program

Description

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory.

From the CVE Program.

Affected software

SoftwareAffected versions
ContaoServers and applications · cna:contao|contao
  • From 4.0.0 before 5.3.54
  • From 5.4.0-RC1 before 5.7.17
  • From 6.0.0-RC1 before 6.0.6

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126663