EUVD-2026-125042

Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo and serialized session data omit two-factor state, attackers already holding a session...

CVE-2026-128335

The Contao CMS (versions 4.6.0 before 5.3.54 , 5.4.0-RC1 before 5.7.17 , and 6.0.0-RC1 before 6.0.6 ) is vulnerable to a Session Invalidation Failure when modifying two-factor authentication (2FA) settings. The root cause is that the Contao\User::isEqualTo() function and serialized session data d...

Contao <4.13.3 - Cross-Site Scripting

Contao prior to 4.13.3 contains a cross-site scripting vulnerability. It is possible to inject arbitrary JavaScript code into the canonical tag. id: CVE-2022-24899 info: name: Contao 4.13.3 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Contao prior to 4.13.3 contains...

CVE-2026-126662

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or...

CVE-2026-126663

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the image:: insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass...

CVE-2026-126663

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the image:: insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass...

CVE-2026-126663 Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the image:: insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass...

EUVD-2026-123405

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the image:: insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass...

CVE-2026-126663 Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the image:: insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass...

CVE-2026-126663

The Contao CMS (versions 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6) is vulnerable to a path traversal flaw in the {{image::}} insert tag. The root cause is a Validation Before Canonicalization issue (CWE-180) where percent-encoded sequences like ..%2f bypass the Validator::...

EUVD-2026-123404

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or...

CVE-2026-126662

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or...

CVE-2026-126662 Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or...

CVE-2026-126662 Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or...

CVE-2026-126662

Contao versions 4.0.0 before 5.3.54 , 5.4.0 before 5.7.17 , and 6.0.0 before 6.0.6 are vulnerable to an access control bypass in the file manager Edit-Multiple operation. The root cause allows backend users with filemount restrictions to modify folders outside their designated area. Specifically,...

CVE-2022-26265

CVE-2022-26265 Contao CMS RCE This repo is part of the hgrab-framework Affected product Contao CMS v1.5.0 Installation Install the app on the server user@domain: git clone https://github.com/sh4den/CVE-2022-26265.git user@domain: cd ./CVE-2022-26265/ user@domain: python3 main.py The list file mus...

PT-2026-145212

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or...

PT-2026-145213

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the image:: insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass...

CVE-2026-126663: Contao: Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that…

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the image:: insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass...

CVE-2026-126662: Contao: Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability…

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or...