---
id: "CVE-2026-126663"
page: "https://infrastack.ai/live/CVE-2026-126663"
kind: "vulnerability"
aliases: ["CVE-2026-126663"]
title: "Contao: content editors can read arbitrary image files via insert tag"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["contao", "package", "php", "self-hosted"]
not_affected_if: ["no-untrusted-editors", "unaffected-version"]
published_at: "2026-11-11T13:17:24+00:00"
first_seen_at: "2026-11-11T13:27:16+00:00"
updated_at: "2026-11-11T13:29:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126663", "first_seen_at": "2026-11-11T13:27:16+00:00"}]
exploit_sources: []
---

# Contao: content editors can read arbitrary image files via insert tag

Link for people: https://infrastack.ai/live/CVE-2026-126663 (this .md is for agents)

Contao's {{image::}} insert tag accepts percent-encoded path traversal sequences such as ..%2f that bypass its path check, so a content editor can make the frontend resize and serve image files outside the files directory. An attacker with editor access can read any image file the web server can open.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Contao version with `composer show contao/core-bundle` or `composer show contao/manager-bundle`
- Review whether any `{{image::}}` insert tags in content use encoded `..%2f` sequences

## Fix

- Contao 4.0.0 before 5.3.54: move to `5.3.54` or later
- Contao 5.4.0 before 5.7.17: move to `5.7.17` or later
- Contao 6.0.0 before 6.0.6: move to `6.0.6` or later

## Timeline

- 2026-11-11T13:27:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126663

## Documents

- [advisory] Vendor advisory: github.com https://github.com/contao/contao/security/advisories/GHSA-r7cf-mfp4-r23h
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-path-traversal-via-image-insert-tag
- [fix] Patch: github.com https://github.com/contao/contao/commit/e820e3c9d79a5c07f274558513c8db08a79bf804
- [fix] Release notes: github.com https://github.com/contao/contao/releases/tag/5.3.54
- [fix] Patch: github.com https://github.com/contao/contao/commit/0f7989eb5b28d85dcd441ef22f80f8af4f56433e
- [fix] Release notes: github.com https://github.com/contao/contao/releases/tag/6.0.6
- [fix] Release notes: github.com https://github.com/contao/contao/releases/tag/5.7.17
- [fix] Patch: github.com https://github.com/contao/contao/commit/688c0f6213afbd000cd22ad0a44555eca80b40ab

## From the sources

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_