CVE-2026-55825: Contao Path Traversal Vulnerability in Job Download URIs
Summary
CVE-2026-55825: Contao: Possible path traversal in job download URIs. Affects contao/contao versions >= 5.7.0, < 5.7.7. Fixed in 5.7.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) designed for building and managing websites. It offers a user-friendly interface and a range of features, including a flexible templating system, a powerful media manager, and support for multiple languages. However, a vulnerability has been identified in the way Contao handles job attachment downloads, which could allow unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability arises from a path traversal issue in the job download URIs of Contao. An authenticated backend user can exploit this flaw by manipulating the attachment identifier to include '..' segments, allowing them to access files from other job directories within the 'var/job-attachments' directory. The controller only checks the 'jobUuid' route parameter for authorization, failing to properly restrict access to the attachment identifier. This oversight enables a cross-job authorization bypass, potentially exposing sensitive information contained in job attachments, such as logs and error messages.
How To Fix
Minimum fixed version
5.7.7
This is the first release that contains the fix.
composer require contao/contao:5.7.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the job attachment download endpoint by implementing additional checks on the attachment identifier to prevent the use of '..' segments. This can be done by adding validation logic to the 'Jobs::getAttachment()' method to ensure that the identifier does not contain any path traversal characters.
Conclusion
In summary, the path traversal vulnerability in Contao's job download URIs poses a risk of unauthorized access to sensitive job attachments. It is crucial to update to the patched version 5.7.7 or later and implement additional security measures to mitigate this risk effectively.
See every vulnerability recorded for contao/contao →
FAQ
A low-privileged backend user can read another job's attachment if they know or obtain the target job UUID and attachment filename.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability affects Contao versions from 5.7.0 up to 5.7.6. It is fixed in version 5.7.7.
If you cannot update immediately, implement the suggested workaround to restrict access to the job attachment download endpoint.
The CVSS score of this vulnerability is 3.1, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/contao.
