Read the docs
TI-2026-70130 Aliases CVE-2026-107844GHSA-mrvp-7wmx-5m4h

Path traversal in Contao images controller exposes project files

Priority LOW 30CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Contao from 5.0.0 before 5.3.50 and from 5.4.0-RC1 before 5.7.12 does not check that user-supplied paths in its images controller stay inside the image directory (CWE-22). An unauthenticated remote attacker can retrieve files from the project directory whose names use an extension allowed by contao.image.valid_extensions.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBasePath() to verify that the canonical path remains inside that directory. An unauthenticated request containing encoded parent-directory segments can therefore return files under the project directory through BinaryFileResponse when their names use an extension allowed by contao.image.valid_extensions. The route can also reveal whether arbitrary paths exist, and debug responses can disclose absolute filesystem paths, but paths below the upload directory were not shown to be readable. This issue is fixed in versions 5.3.50 and 5.7.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Fixed contao (contao): 5.3.50, 5.7.12contao/core-bundle (Packagist): 5.3.50, 5.7.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
contaocontao5.0.0 to before 5.3.50; 5.4.0-RC1 to before 5.7.125.3.50, 5.7.12Patch availableCNA
—contao/core-bundle (Packagist)4.1.0 to before 5.3.505.3.50Patch availableGHSA-mrvp-7wmx-5m4h
—contao/core-bundle (Packagist)5.4.0-RC1 to before 5.7.125.7.12Patch availableGHSA-mrvp-7wmx-5m4h
  • contao Vendorcontao Affected 5.0.0 to before 5.3.50; 5.4.0-RC1 to before 5.7.12 Fixed in 5.3.50, 5.7.12 Patch available CNA
  • contao/core-bundle (Packagist) Vendor— Affected 4.1.0 to before 5.3.50 Fixed in 5.3.50 Patch available GHSA-mrvp-7wmx-5m4h
  • contao/core-bundle (Packagist) Vendor— Affected 5.4.0-RC1 to before 5.7.12 Fixed in 5.7.12 Patch available GHSA-mrvp-7wmx-5m4h

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*——contao
  • cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* Versions — — ·contao

Remediation

Upgrade contao/core-bundle on Packagist to 5.3.50 or 5.7.12. The sources list no fixed version for contao.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA contao (contao) Fixed in 5.3.50, 5.7.12
  • Fix · GHSA-mrvp-7wmx-5m4h contao/core-bundle (Packagist) Fixed in 5.3.50 Advisory →
  • Fix · GHSA-mrvp-7wmx-5m4h contao/core-bundle (Packagist) Fixed in 5.7.12 Advisory →

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-107844
  2. 2026-10-10 Alias added: GHSA-mrvp-7wmx-5m4h
  3. 2026-10-10 Fix available: Packagist/contao/[email protected], Packagist/contao/[email protected] · GHSA-mrvp-7wmx-5m4h
  4. 2026-10-10 CVSS score added · GHSA-mrvp-7wmx-5m4h
  5. 2026-10-10 Weakness changed · GHSA-mrvp-7wmx-5m4h
  6. 2026-10-10 5 new references · GHSA-mrvp-7wmx-5m4h
  7. 2026-10-14 CISA SSVC decision points changed

References

Other 5

  • TI-2022-09661 Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE)… CVSS 3.1CRITICAL 9.8
  • TI-2024-30849 Unrestricted file upload in Contao CVSS 3.1MEDIUM 6.4
  • TI-2023-18600 Contao cross site scripting vulnerability via input unit widget CVSS 3.1MEDIUM 6.5
  • TI-2014-01453 Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2022-08709 Cross site scripting via canonical tag CVSS 3.1HIGH 7.2
  • TI-2019-08602 Contao 4.x allows SQL Injection. CVSS 3.0CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences