The vulnerability in Contao's JobsController::downloadJobAttachment allows an authenticated backend user to bypass authorization checks for job attachments by exploiting path traversal in the attachment identifier. The controller authorizes access only based on the job UUID route parameter, but the attachment identifier is attacker-controlled and concatenated with the authorized job UUID before path canonicalization. The VirtualFilesystem::resolve method canonicalizes the path and rejects absolute or leading '..' segments but does not ensure the resolved path stays within the authorized job directory. This enables reading files from other job directories inside var/job-attachments by using '../' segments in the identifier. The vulnerability affects Contao versions >=5.7.0 and <5.7.7. The recommended fix involves treating the attachment identifier strictly as a filename, rejecting slashes and dot-segments, enforcing route requirements to prevent slashes, and verifying the resolved path starts with the authorized job UUID.

An authenticated backend user with access to one job can read attachments belonging to other jobs if they know or can guess the target job UUID and attachment filename. This leads to unauthorized disclosure of potentially sensitive job-related files such as debug logs and crawler job CSV logs containing URLs, referring URLs, tags, and error messages. The impact is limited by the need for authentication and knowledge of valid job UUIDs and filenames. The CVSS score is 3.1 (Low), reflecting low confidentiality impact and high attack complexity.

A patch is available for this vulnerability. The vendor recommends rejecting slashes, backslashes, NUL characters, and dot-segment components in the attachment identifier to treat it strictly as a filename. Additionally, route requirements should prevent slashes in the identifier. After path resolution, the system must verify that the canonical relative path starts with the authorized job UUID directory before allowing access. The same validation should be applied when adding attachments to prevent writing outside the authorized job directory. Users should apply the official fix in versions 5.7.7 or later.