CVE-2026-107844 in Contao
Summary
by MITRE • 10/09/2026
Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBasePath() to verify that the canonical path remains inside that directory. An unauthenticated request containing encoded parent-directory segments can therefore return files under the project directory through BinaryFileResponse when their names use an extension allowed by contao.image.valid_extensions. The route can also reveal whether arbitrary paths exist, and debug responses can disclose absolute filesystem paths, but paths below the upload directory were not shown to be readable. This issue is fixed in versions 5.3.50 and 5.7.12.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Contao content management systems between version 5.0.0 and specific patched releases represents a critical path traversal flaw within the ImagesController component. As an open-source CMS widely used for web development, Contao relies on secure handling of file system operations to prevent unauthorized access to sensitive project files. The core technical deficiency lies in how the application processes user-supplied input for image retrieval. Specifically, when constructing the target directory path from a user-controlled parameter named path, the framework utilizes Path::join() to concatenate this input with the configured base directory. While Path::join() effectively normalizes and combines paths, it does not inherently validate whether the resulting canonical path remains within the intended boundaries of the image storage location. The absence of a subsequent verification step using Path::isBasePath() creates an exploitable gap where malicious actors can manipulate the file system navigation logic to escape the restricted directory structure.
This architectural oversight allows unauthenticated attackers to execute arbitrary read operations on files located outside the designated upload or image directories, provided those target files possess extensions listed in the contao.image.valid_extensions configuration setting. By injecting encoded parent-directory segments such as ../ sequences into the path parameter, an attacker can traverse up the directory hierarchy and access sensitive project files that are not intended for public exposure. The vulnerability is particularly dangerous because it does not require authentication, enabling any internet user to probe the server's file system structure. Furthermore, the BinaryFileResponse mechanism used to serve these files ensures that once a valid path within the allowed extensions is identified, the content of those files can be downloaded directly by the attacker. This capability transforms what might seem like a simple image serving feature into a powerful tool for data exfiltration and reconnaissance.
The operational impact of this vulnerability extends beyond direct file reading to include significant information disclosure risks. The endpoint serves as an effective probe for directory existence, allowing attackers to enumerate files and directories within the project structure by observing response codes or behaviors that indicate presence versus absence of resources. In scenarios where debug modes are active or error handling is misconfigured, responses may disclose absolute filesystem paths on the server. Such disclosures provide valuable context for further exploitation attempts, including local file inclusion attacks or more targeted path traversal exploits against other components of the application stack. Although reports indicate that files located below the primary upload directory were not demonstrably readable through this specific vector, the ability to access configuration files, source code, or environment variables within the project root poses a severe threat to system integrity and confidentiality.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. It also maps to MITRE ATT&CK techniques related to Discovery, specifically T1083: File and Directory Discovery, where adversaries gather information about the target environment to facilitate further attacks. The lack of strict input validation regarding directory boundaries is a classic example of insufficient security controls in file handling routines. To mitigate this risk, organizations running affected versions must upgrade immediately to Contao version 5.3.50 or 5.7.12 and later, which implement the necessary path canonicalization checks using Path::isBasePath(). For systems that cannot be patched instantly, administrators should ensure that debug modes are disabled in production environments to prevent absolute path leakage and restrict web server permissions so that even if traversal occurs, access to critical system files is blocked by operating system level controls. Regular auditing of file handling logic against CWE standards is recommended to prevent similar vulnerabilities in custom extensions or modules.