CVE-2026-55825

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. The later attachment lookup joins that authorized job UUID with the attacker-controlled identifier, then passes the combined path to the virtual filesystem. VirtualFilesystem::resolve() canonicalizes the whole path and only rejects paths that escape the filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes victim-job/debug_log.csv. This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values.

• CWE-22

• https://github.com/contao/contao/security/advisories/GHSA-grm4-wm43-9jh5

Published

Jul 31, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55809Improperly Controlled Modification of Dynamically-Determined…8.1
• CVE-2026-5581The Multi Uploader for Gravity Forms plugin for WordPress is…9.1
• CVE-2026-55810Improperly Controlled Modification of Dynamically-Determined…8.1
• CVE-2026-55814Missing Authentication in Apache Ranger Download APIs on ver…7.5
• CVE-2026-5582The FuseWP plugin for WordPress is vulnerable to Cross-Site …4.3
• CVE-2026-55824Contao is an Open Source CMS. In versions 4.13.40 through 5.…2.6
• CVE-2026-55827FreeRDP is a free implementation of the Remote Desktop Proto…8.8
• CVE-2026-55828qbee transport is a remote access transport protocol impleme…6
• CVE-2026-5583A security vulnerability has been detected in PHPGurukul Onl…6.3
• CVE-2026-55830RestrictedPython is a tool that helps to define a subset of …8.3
• CVE-2026-55831Netty is a network application framework for development of …7.5
• CVE-2026-55832Tract is a tiny, no-nonsense, self-contained TensorFlow and …6.1