CVE-2026-107844

Name of the Vulnerable Software and Affected Versions Contao versions prior to 5.3.50 Contao versions prior to 5.7.12

Description An issue exists where the ImagesController joins the user-controlled {path} parameter to the configured image target directory using Path::join() without utilizing Path::isBasePath() to verify that the resulting canonical path remains within the intended directory. An unauthenticated request using encoded parent-directory segments can bypass directory boundaries, allowing the BinaryFileResponse to return files located under the project directory, provided the filenames use an extension permitted by contao.image.valid extensions. Additionally, the route can be used as an existence oracle to determine if arbitrary paths exist, and instances with debug mode enabled may disclose absolute filesystem paths in 404 error messages. This behavior affects Apache installations using the shipped public/.htaccess and nginx installations using the documented configuration.

Recommendations Update to version 5.3.50. Update to version 5.7.12.