{"id":"CVE-2026-126663","kind":"vulnerability","aliases":["CVE-2026-126663"],"related":[],"title":"Contao: content editors can read arbitrary image files via insert tag","description":"Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory.","summary":"Contao's {{image::}} insert tag accepts percent-encoded path traversal sequences such as ..%2f that bypass its path check, so a content editor can make the frontend resize and serve image files outside the files directory. An attacker with editor access can read any image file the web server can open.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["contao","package","php","self-hosted"],"not_affected_if":["no-untrusted-editors","unaffected-version"],"how_to_check":"- Check the installed Contao version with `composer show contao/core-bundle` or `composer show contao/manager-bundle`\n- Review whether any `{{image::}}` insert tags in content use encoded `..%2f` sequences","fix":"- Contao 4.0.0 before 5.3.54: move to `5.3.54` or later\n- Contao 5.4.0 before 5.7.17: move to `5.7.17` or later\n- Contao 6.0.0 before 6.0.6: move to `6.0.6` or later","status":"open","published_at":"2026-11-11T13:17:24+00:00","first_seen_at":"2026-11-11T13:27:16+00:00","triaged_at":"2026-11-11T13:29:29+00:00","updated_at":"2026-11-11T13:29:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T13:29:29Z","model":"claude-haiku-5-5","output":{"fix":"- Contao 4.0.0 before 5.3.54: move to `5.3.54` or later\n- Contao 5.4.0 before 5.7.17: move to `5.7.17` or later\n- Contao 6.0.0 before 6.0.6: move to `6.0.6` or later","reach":"network","title":"Contao: content editors can read arbitrary image files via insert tag","impact":"medium","summary":"Contao's {{image::}} insert tag accepts percent-encoded path traversal sequences such as ..%2f that bypass its path check, so a content editor can make the frontend resize and serve image files outside the files directory. An attacker with editor access can read any image file the web server can open.","audience":"businesses","category":"package","nicknames":[],"who_cares":["contao","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"image files readable anywhere on the server filesystem by editors","analyst_note":"","how_to_check":"- Check the installed Contao version with `composer show contao/core-bundle` or `composer show contao/manager-bundle`\n- Review whether any `{{image::}}` insert tags in content use encoded `..%2f` sequences","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["unaffected-version","no-untrusted-editors"],"who_is_affected":"Sites running affected Contao versions where content editors have back-end access to insert content with the image insert tag. The flaw is in the frontend image resize path, so exposure depends on who can edit content. Sites on unaffected versions can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000773,"input_tokens":4760,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126663':14A,17A '-2026':13A,16A '2f':38B,117C '4.0.0':77C '5.3.54':79C '5.4.0':80C '5.7.17':82C '6.0.0':84C '6.0.6':86C 'accept':29B 'access':65B 'allow':93C 'anywher':100C 'arbitrari':6A 'attack':62B,109C 'bypass':40B 'check':43B 'contain':87C 'contao':1A,18B,24B,76C 'content':2A,46B,94C 'cve':12A,15A 'directori':60B,136C 'editor':3A,47B,64B,95C 'emb':111C 'encod':32B,114C 'file':8A,56B,59B,70B,99C,132C,135C 'filesystem':103C 'frontend':51B,126C 'host':23B 'imag':7A,26B,55B,69B,98C,106C,131C 'insert':10A,27B,107C 'isinsecurepath':121C 'like':116C 'make':49B,124C 'open':75B 'outsid':57B,133C 'packag':19B 'pass':119C 'path':33B,42B,89C 'percent':31B,113C 'percent-encod':30B,112C 'php':20B 'rawurldecod':123C 'read':5A,67B,97C 'readabl':130C 'resiz':52B,127C 'self':22B 'self-host':21B 'sequenc':35B,115C 'serv':54B,129C 'server':73B 'tag':11A,28B,108C 'travers':34B,90C 'valid':120C 'via':9A,104C 'vulner':91C 'web':72B","nicknames":[],"mitigations":[],"who_affected":"Sites running affected Contao versions where content editors have back-end access to insert content with the image insert tag. The flaw is in the frontend image resize path, so exposure depends on who can edit content. Sites on unaffected versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["contao","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-126663':14A,17A '-2026':13A,16A 'arbitrari':6A 'contao':1A 'content':2A 'cve':12A,15A 'editor':3A 'file':8A 'imag':7A 'insert':10A 'read':5A 'tag':11A 'via':9A","search_b":"'2f':38B 'accept':29B 'access':65B 'attack':62B 'bypass':40B 'check':43B 'contao':18B,24B 'content':46B 'directori':60B 'editor':47B,64B 'encod':32B 'file':56B,59B,70B 'frontend':51B 'host':23B 'imag':26B,55B,69B 'insert':27B 'make':49B 'open':75B 'outsid':57B 'packag':19B 'path':33B,42B 'percent':31B 'percent-encod':30B 'php':20B 'read':67B 'resiz':52B 'self':22B 'self-host':21B 'sequenc':35B 'serv':54B 'server':73B 'tag':28B 'travers':34B 'web':72B","search_c":"'2f':117C '4.0.0':77C '5.3.54':79C '5.4.0':80C '5.7.17':82C '6.0.0':84C '6.0.6':86C 'allow':93C 'anywher':100C 'attack':109C 'contain':87C 'contao':76C 'content':94C 'directori':136C 'editor':95C 'emb':111C 'encod':114C 'file':99C,132C,135C 'filesystem':103C 'frontend':126C 'imag':98C,106C,131C 'insert':107C 'isinsecurepath':121C 'like':116C 'make':124C 'outsid':133C 'pass':119C 'path':89C 'percent':113C 'percent-encod':112C 'rawurldecod':123C 'read':97C 'readabl':130C 'resiz':127C 'sequenc':115C 'serv':129C 'tag':108C 'travers':90C 'valid':120C 'via':104C 'vulner':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T07:13:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126663","severity":null,"published_at":"2026-11-11T13:17:24+00:00","modified_at":"2026-11-11T13:17:24+00:00","first_seen_at":"2026-11-11T13:27:16+00:00","fetched_at":"2026-11-11T13:27:16+00:00","note":null}],"documents":[{"id":125701,"url":"https://github.com/contao/contao/commit/0f7989eb5b28d85dcd441ef22f80f8af4f56433e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":125702,"url":"https://github.com/contao/contao/commit/688c0f6213afbd000cd22ad0a44555eca80b40ab","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":125703,"url":"https://github.com/contao/contao/commit/e820e3c9d79a5c07f274558513c8db08a79bf804","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":125696,"url":"https://github.com/contao/contao/releases/tag/5.3.54","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":125697,"url":"https://github.com/contao/contao/releases/tag/5.7.17","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":125698,"url":"https://github.com/contao/contao/releases/tag/6.0.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":125707,"url":"https://github.com/contao/contao/security/advisories/GHSA-r7cf-mfp4-r23h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T07:13:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":125708,"url":"https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-path-traversal-via-image-insert-tag","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}