CVE-2026-126662 · Package
NO FIX YET · SEE WHAT TO DO
Contao's file manager Edit-Multiple operation lets a backend user with filemount restrictions modify folders outside their allowed mount when they hold the protected or syncExclude field permission. An attacker can publish protected folders for public download or exclude them from DBAFS synchronization, exposing files.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Contao 4.0.0 through 5.3.x, 5.4.x through 5.7.16, or 6.0.x before 6.0.6 with backend users who have filemount restrictions and the protected or syncExclude permission. Sites without such backend users, or on the fixed versions, are not exposed.
Not affected if fixed-version, no-filemount-users
Who cares contao, php, self-hosted
composer show contao/core-bundle and compare against the fixed ranges.5.3.54 or later5.7.17 or later6.0.6 or laterContao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.