CVE-2026-126662

EUVD-2026-123404
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
contaocontao
4.0.0 ≤
𝑥
< 5.3.54
CNA
contaocontao
𝑥
< 5.7.17
CNA
contaocontao
𝑥
< 6.0.6
CNA
Common Weakness Enumeration
References
https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folder.php#L1716-L1720
https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70
https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66
https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900
https://github.com/contao/contao/releases/tag/5.3.54
https://github.com/contao/contao/releases/tag/5.7.17
https://github.com/contao/contao/releases/tag/6.0.6
https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj
https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiple