Threats affecting pkg:composer/Contao

CVE-2026-126663 is a path traversal vulnerability in Contao versions 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6. It allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag by exploiting incorrect validation order of paths. Attackers can use percent-encoded sequences to bypass the Validator::isInsecurePath() check, causing the frontend to serve files outside the intended directory.

CVE-2026-126662 is an access control bypass vulnerability in Contao versions 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6. It allows filemount-restricted backend users with certain permissions to modify folders outside their authorized filemount via the file manager's Edit-Multiple operation. This can lead to publishing protected folders or excluding them from synchronization, potentially exposing files for public download.

Contao versions 5.7.0 through 5.7.6 contain a path traversal vulnerability in the job attachment download endpoint. An authenticated backend user with access to one job can manipulate the attachment identifier to read files from other job directories within the job attachments storage. This occurs because the system canonicalizes the combined path but does not enforce that the resolved path remains within the authorized job directory. The vulnerability allows reading of attachments such as CSV logs from other jobs if the attacker knows the target job UUID and attachment filename.

Contao's crawler has a vulnerability where authentication credentials configured for HTTP Basic or Bearer authentication can be leaked to external hosts during crawling. This occurs because the crawler's cleaning function removes incorrect option keys instead of the actual Symfony HttpClient authentication keys, causing credentials to be sent with requests to external URLs. An attacker can exploit this by causing the crawler to visit a malicious external URL, thereby receiving the crawler's credentials. The vulnerability affects Contao versions from 4.13.0 up to but not including 5.3.47, and from 5.4.0 up to but not including 5.7.7. A patch is available to fix the issue by properly stripping the correct authentication options.