Core bundle: Contao: Path traversal in the images controller (CVE-2026-107844)

The ImagesController in Contao core bundle improperly handles user-supplied path input by joining it to the image target directory without verifying that the resulting canonical path remains within that directory. This allows an unauthenticated GET request with percent-encoded dot segments to escape the directory boundary and retrieve files with extensions listed in contao.image.valid_extensions. The vulnerability affects Apache and nginx configurations shipped or documented with Contao. While the vulnerability permits reading files outside the document root, attempts to access files below the upload directory result in server errors, restricting the scope of accessible files. The route also acts as an existence oracle and can disclose absolute paths when debug mode is enabled.

An unauthenticated attacker can read files with certain image extensions located anywhere under the project directory, outside the intended image directory. This can lead to information disclosure of files not meant to be publicly accessible. The vulnerability also allows attackers to verify the existence of arbitrary paths and may disclose absolute filesystem paths if debug mode is enabled. However, the inability to read files below the upload directory limits the severity of the exposure.

A patch is available for this vulnerability. Users should upgrade to Contao core bundle versions 5.3.50 or later for the 4.x branch, and 5.7.12 or later for the 5.x branch to remediate this issue. Until patched, consider restricting access to the affected route or disabling debug mode to prevent disclosure of absolute paths.