Threats tagged 'ghsa-grm4-wm43-9jh5'

Contao versions 5.7.0 through 5.7.6 contain a path traversal vulnerability in the job attachment download endpoint. An authenticated backend user with access to one job can manipulate the attachment identifier to read files from other job directories within the job attachments storage. This occurs because the system canonicalizes the combined path but does not enforce that the resolved path remains within the authorized job directory. The vulnerability allows reading of attachments such as CSV logs from other jobs if the attacker knows the target job UUID and attachment filename.