CVE-2026-55825 in Contao
Summary
by MITRE • 07/31/2026
Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. The later attachment lookup joins that authorized job UUID with the attacker-controlled identifier, then passes the combined path to the virtual filesystem. VirtualFilesystem::resolve() canonicalizes the whole path and only rejects paths that escape the filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes victim-job/debug_log.csv. This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability exists within Contao CMS versions 5.7.0 through 5.7.6 and represents a critical authorization bypass flaw that allows authenticated backend users to access job attachments from other jobs within the system. The vulnerability stems from improper path validation in the job attachment download endpoint where the system only validates the jobUuid route parameter while failing to properly sanitize the attacker-controlled attachment identifier parameter. This creates a directory traversal condition that enables attackers to manipulate file paths through the use of ../ segments, effectively allowing them to escape their authorized job directory and access files belonging to other jobs.
The technical implementation of this vulnerability follows a specific pattern where the controller authorizes access based solely on the jobUuid parameter but then combines this authorized UUID with the attacker-controlled identifier in a manner that bypasses proper path validation. The virtual filesystem component processes the combined path through VirtualFilesystem::resolve() method which canonicalizes the entire path structure, yet only rejects paths that escape the filesystem mount boundaries rather than properly validating that the final resolved path remains within the intended job directory context. This allows an attacker to construct malicious paths such as authorized-job/../victim-job/debug_log.csv where the ../ segment effectively navigates to the victim job directory while maintaining the authorization context from the original job.
The operational impact of this vulnerability is significant as it enables cross-job data access, potentially exposing sensitive information stored in job attachment directories including debug logs, configuration files, or other job-specific data that should remain isolated between different jobs. This represents a direct violation of the principle of least privilege and could lead to information disclosure attacks where attackers can systematically access job data from multiple victims within the same system. The vulnerability is particularly concerning because it leverages existing legitimate authorization mechanisms while exploiting a flaw in path resolution rather than attempting brute force attacks against UUID v4 values, which are sufficiently random to prevent practical brute force attempts.
This vulnerability maps directly to CWE-22: Improper Limitation of a Pathname to a Restricted Directory and aligns with ATT&CK technique T1078.004: Valid Accounts - Cloud Accounts in the context of unauthorized access to job-specific data within cloud-based CMS environments. The attack requires an authenticated backend user account with access to at least one job, making it a privilege escalation vulnerability that allows lateral movement between job directories without requiring additional authentication or elevated privileges. Organizations should implement immediate mitigations including proper path validation that ensures all resolved paths remain within the authorized job directory boundaries and restricts path traversal sequences regardless of authorization context. The fix should enforce strict path canonicalization rules that prevent any form of directory traversal manipulation, particularly when combining user-controlled inputs with authorized identifiers. Additionally, implementing comprehensive input sanitization measures for attachment identifiers and establishing proper access controls that validate all file paths against the intended job directory boundaries would effectively neutralize this class of vulnerability while maintaining system functionality.
The vulnerability demonstrates a classic case of insufficient input validation combined with inadequate path resolution security controls in a content management system environment. The root cause lies in the improper separation of authorization logic from path resolution logic, where the authorization check occurs on one parameter while path construction and validation occurs on multiple parameters without proper sanitization. This flaw is particularly dangerous in CMS environments where multiple users may have access to different job contexts but should not be able to access each other's data. The vulnerability also highlights the importance of secure coding practices around virtual filesystem operations and demonstrates how seemingly benign path manipulation can lead to significant security implications when authorization and validation controls are not properly coordinated. Organizations using Contao CMS should urgently apply patches addressing this issue while implementing additional monitoring for unauthorized file access patterns within job attachment directories.