---
id: "CVE-2026-126662"
page: "https://infrastack.ai/live/CVE-2026-126662"
kind: "vulnerability"
aliases: ["CVE-2026-126662"]
title: "Contao: filemount-restricted backend users can change folders outside their mount"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["contao", "package", "php", "self-hosted"]
not_affected_if: ["fixed-version", "no-filemount-users"]
published_at: "2026-11-11T13:17:24+00:00"
first_seen_at: "2026-11-11T13:27:16+00:00"
updated_at: "2026-11-11T13:29:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126662", "first_seen_at": "2026-11-11T13:27:16+00:00"}]
exploit_sources: []
---

# Contao: filemount-restricted backend users can change folders outside their mount

Link for people: https://infrastack.ai/live/CVE-2026-126662 (this .md is for agents)

Contao's file manager Edit-Multiple operation lets a backend user with filemount restrictions modify folders outside their allowed mount when they hold the protected or syncExclude field permission. An attacker can publish protected folders for public download or exclude them from DBAFS synchronization, exposing files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Contao version with `composer show contao/core-bundle` and compare against the fixed ranges.
- Review backend users who have the protected or syncExclude field permission and a filemount restriction.

## Fix

- Contao 4.x before 5.3.54: move to `5.3.54` or later
- Contao 5.4 before 5.7.17: move to `5.7.17` or later
- Contao 6.0 before 6.0.6: move to `6.0.6` or later

## Timeline

- 2026-11-11T13:27:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126662

## Documents

- [advisory] Vendor advisory: github.com https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiple
- [fix] Patch: github.com https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900
- [fix] Release notes: github.com https://github.com/contao/contao/releases/tag/5.3.54
- [fix] Patch: github.com https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70
- [fix] Release notes: github.com https://github.com/contao/contao/releases/tag/6.0.6
- [fix] Release notes: github.com https://github.com/contao/contao/releases/tag/5.7.17
- [fix] Patch: github.com https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66

## From the sources

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_