CVE-2026-107844: Contao Core Bundle Path Traversal Vulnerability
Summary
CVE-2026-107844: Contao: Path traversal in the images controller. Affects contao/core-bundle across 2 version ranges.
>= 4.1.0, < 5.3.50
>= 5.4.0-RC1, < 5.7.12
Fixed in 5.3.50 or 5.7.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that enables users to create and manage websites with ease. It offers a range of features including a user-friendly interface, flexible layout options, and extensive customization capabilities. However, it is susceptible to a path traversal vulnerability in its ImagesController, which can be exploited by unauthenticated users to access sensitive files outside the intended directory.
Vulnerability Detail
The vulnerability arises from the ImagesController's handling of user-controlled paths. It uses Path::join() to concatenate the user input with the configured image target directory, but fails to validate that the resulting path remains within the intended directory. This oversight allows an attacker to exploit percent-encoded dot segments to traverse directories and access files that should be restricted. The impact is significant as it permits unauthorized access to files with specific extensions (e.g., jpg, png) located anywhere within the project directory, potentially exposing sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.1.0, < 5.3.505.3.50composer require contao/core-bundle:5.3.50 -
>= 5.4.0-RC1, < 5.7.125.7.12composer require contao/core-bundle:5.7.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the web server configuration restricts access to sensitive directories and files. Additionally, consider implementing input validation to sanitize user inputs before processing them in the ImagesController.
Conclusion
The path traversal vulnerability in the Contao Core Bundle poses a significant risk by allowing unauthorized access to sensitive files. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, employing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for contao/core-bundle →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
No, this vulnerability can be exploited by unauthenticated users, making it more critical.
Files with extensions such as jpg, jpeg, gif, png, tif, tiff, bmp, svg, svgz, and webp can be accessed.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, implement strict server configurations and input validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
