GHSA-GRM4-WM43-9JH5 Contao: Possible path traversal in job download URIs

Summary An authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. Th...

Contao: Possible path traversal in job download URIs

Summary An authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. Th...

CVE-2026-55825

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

CVE-2026-55825 Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

CVE-2026-55825

CVE-2026-55825 (Contao) : Affected are Contao core-bundle versions 5.7.0–5.7.6. An authenticated backend user who can access one job can craft an attachment identifier containing ../ segments to have the job attachment download endpoint read a file from another job directory inside var/job-attach...

CVE-2026-55825: Improper Limitation of a Pathname to a Restricted Directory

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

PT-2026-66847

Name of the Vulnerable Software and Affected Versions Contao versions 5.7.0 through 5.7.6 Description An authenticated backend user with access to a specific job can perform a cross-job authorization bypass. By requesting an attachment identifier containing ../ segments, the user can force the jo...

Directory Traversal

Overview contao/core-bundle is an Open Source PHP Content Management System for people who want a professional website that is easy to maintain. Affected versions of this package are vulnerable to Directory Traversal due to an authenticated backend user who can access one job can request an...