{"id":"CVE-2026-126662","kind":"vulnerability","aliases":["CVE-2026-126662"],"related":[],"title":"Contao: filemount-restricted backend users can change folders outside their mount","description":"Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.","summary":"Contao's file manager Edit-Multiple operation lets a backend user with filemount restrictions modify folders outside their allowed mount when they hold the protected or syncExclude field permission. An attacker can publish protected folders for public download or exclude them from DBAFS synchronization, exposing files.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["contao","package","php","self-hosted"],"not_affected_if":["fixed-version","no-filemount-users"],"how_to_check":"- Check the installed Contao version with `composer show contao/core-bundle` and compare against the fixed ranges.\n- Review backend users who have the protected or syncExclude field permission and a filemount restriction.","fix":"- Contao 4.x before 5.3.54: move to `5.3.54` or later\n- Contao 5.4 before 5.7.17: move to `5.7.17` or later\n- Contao 6.0 before 6.0.6: move to `6.0.6` or later","status":"open","published_at":"2026-11-11T13:17:24+00:00","first_seen_at":"2026-11-11T13:27:16+00:00","triaged_at":"2026-11-11T13:29:12+00:00","updated_at":"2026-11-11T13:29:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T13:29:12Z","model":"claude-haiku-5-5","output":{"fix":"- Contao 4.x before 5.3.54: move to `5.3.54` or later\n- Contao 5.4 before 5.7.17: move to `5.7.17` or later\n- Contao 6.0 before 6.0.6: move to `6.0.6` or later","reach":"network","title":"Contao: filemount-restricted backend users can change folders outside their mount","impact":"medium","summary":"Contao's file manager Edit-Multiple operation lets a backend user with filemount restrictions modify folders outside their allowed mount when they hold the protected or syncExclude field permission. An attacker can publish protected folders for public download or exclude them from DBAFS synchronization, exposing files.","audience":"businesses","category":"package","nicknames":[],"who_cares":["contao","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Restricted backend user exposes protected folder files publicly","analyst_note":"","how_to_check":"- Check the installed Contao version with `composer show contao/core-bundle` and compare against the fixed ranges.\n- Review backend users who have the protected or syncExclude field permission and a filemount restriction.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-filemount-users"],"who_is_affected":"Sites running Contao 4.0.0 through 5.3.x, 5.4.x through 5.7.16, or 6.0.x before 6.0.6 with backend users who have filemount restrictions and the protected or syncExclude permission. Sites without such backend users, or on the fixed versions, are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4761,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126662':15A,18A '-2026':14A,17A '4.0.0':73C '5.3.54':75C '5.4.0':76C '5.7.17':78C '6.0.0':80C '6.0.6':82C 'access':85C 'allow':44B,90C 'attack':56B,110C 'backend':5A,35B,94C 'bypass':87C 'chang':8A 'contain':83C 'contao':1A,19B,25B,72C 'control':86C 'cve':13A,16A 'dbaf':68B,135C 'download':63B,141C 'edit':30B,107C 'edit-multipl':29B,106C 'exclud':65B,132C 'expos':70B,137C 'field':53B,116C 'file':27B,71B,104C,138C 'filemount':3A,38B,92C,101C 'filemount-restrict':2A,91C 'folder':9A,41B,60B,98C,121C,130C 'hold':48B,111C 'host':24B 'id':125C 'let':33B 'manag':28B,105C 'modifi':40B,97C 'mount':12A,45B 'multipl':31B,108C 'oper':32B,109C 'outsid':10A,42B,99C,120C 'packag':20B 'paramet':126C 'path':122C 'permiss':54B,117C 'php':21B 'protect':50B,59B,113C,129C 'public':62B,140C 'publish':58B,128C 'restrict':4A,39B,93C 'self':23B 'self-host':22B 'submit':119C 'syncexclud':52B,115C 'synchron':69B,136C 'user':6A,36B,95C 'via':102C 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running Contao 4.0.0 through 5.3.x, 5.4.x through 5.7.16, or 6.0.x before 6.0.6 with backend users who have filemount restrictions and the protected or syncExclude permission. Sites without such backend users, or on the fixed versions, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["contao","high","package","php","selfhosted"],"campaign_type":null,"search_a":"'-126662':15A,18A '-2026':14A,17A 'backend':5A 'chang':8A 'contao':1A 'cve':13A,16A 'filemount':3A 'filemount-restrict':2A 'folder':9A 'mount':12A 'outsid':10A 'restrict':4A 'user':6A","search_b":"'allow':44B 'attack':56B 'backend':35B 'contao':19B,25B 'dbaf':68B 'download':63B 'edit':30B 'edit-multipl':29B 'exclud':65B 'expos':70B 'field':53B 'file':27B,71B 'filemount':38B 'folder':41B,60B 'hold':48B 'host':24B 'let':33B 'manag':28B 'modifi':40B 'mount':45B 'multipl':31B 'oper':32B 'outsid':42B 'packag':20B 'permiss':54B 'php':21B 'protect':50B,59B 'public':62B 'publish':58B 'restrict':39B 'self':23B 'self-host':22B 'syncexclud':52B 'synchron':69B 'user':36B","search_c":"'4.0.0':73C '5.3.54':75C '5.4.0':76C '5.7.17':78C '6.0.0':80C '6.0.6':82C 'access':85C 'allow':90C 'attack':110C 'backend':94C 'bypass':87C 'contain':83C 'contao':72C 'control':86C 'dbaf':135C 'download':141C 'edit':107C 'edit-multipl':106C 'exclud':132C 'expos':137C 'field':116C 'file':104C,138C 'filemount':92C,101C 'filemount-restrict':91C 'folder':98C,121C,130C 'hold':111C 'id':125C 'manag':105C 'modifi':97C 'multipl':108C 'oper':109C 'outsid':99C,120C 'paramet':126C 'path':122C 'permiss':117C 'protect':113C,129C 'public':140C 'publish':128C 'restrict':93C 'submit':119C 'syncexclud':115C 'synchron':136C 'user':95C 'via':102C 'vulner':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T07:15:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126662","severity":null,"published_at":"2026-11-11T13:17:24+00:00","modified_at":"2026-11-11T13:17:24+00:00","first_seen_at":"2026-11-11T13:27:16+00:00","fetched_at":"2026-11-11T13:27:16+00:00","note":null}],"documents":[{"id":125691,"url":"https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":125694,"url":"https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":125695,"url":"https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":125696,"url":"https://github.com/contao/contao/releases/tag/5.3.54","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":125697,"url":"https://github.com/contao/contao/releases/tag/5.7.17","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":125698,"url":"https://github.com/contao/contao/releases/tag/6.0.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":125699,"url":"https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T07:15:05+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":125700,"url":"https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiple","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}