CVE-2026-55825
Received Received - Intake

Path Traversal in Contao CMS Job Attachment Download

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. The later attachment lookup joins that authorized job UUID with the attacker-controlled identifier, then passes the combined path to the virtual filesystem. VirtualFilesystem::resolve() canonicalizes the whole path and only rejects paths that escape the filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes victim-job/debug_log.csv. This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-08-01
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-55825
EUVD
EUVD-2026-51620

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
contao contao From 5.7.0 (inc) to 5.7.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Contao CMS versions 5.7.0 through 5.7.6. An authenticated backend user can exploit path traversal by including ../ segments in an attachment identifier to access files from other job directories within var/job-attachments. The system only validates the job UUID in the URL but fails to restrict the attachment path, allowing unauthorized access to files across different jobs.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to job attachment files. Inspect var/job-attachments directories for unexpected file reads or downloads. Review server logs for requests to /contao?do=job&act=download with ../ in attachment identifiers. Check for debug_log.csv or similar files accessed outside their intended job directories.

Impact Analysis

If you use Contao CMS versions 5.7.0 to 5.7.6, an attacker with backend access could read sensitive files from other job directories, potentially exposing confidential data like debug logs or attachments not intended for them. This could lead to information disclosure or data leaks.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected Contao versions may face compliance risks if exploited.

Mitigation Strategies

Upgrade Contao to a patched version (5.7.7 or later). If immediate upgrade is not possible, restrict backend user permissions to prevent access to job-related functions. Monitor var/job-attachments directories for suspicious activity and review access logs for unauthorized file access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart