CVE-2026-126663

Name of the Vulnerable Software and Affected Versions Contao versions 4.0.0 through 5.3.53 Contao versions 5.4.0 through 5.7.16 Contao versions 6.0.0 through 6.0.5

Description A path traversal issue allows content editors to read image files from any location on the filesystem using the {{image::}} insert tag. This occurs because percent-encoded sequences, such as ..%2f, can bypass the Validator::isInsecurePath() function before rawurldecode() is applied. Consequently, the frontend may resize and serve image files located outside the designated files directory.

Recommendations Update Contao versions 4.0.0 through 5.3.53 to version 5.3.54 or later. Update Contao versions 5.4.0 through 5.7.16 to version 5.7.17 or later. Update Contao versions 6.0.0 through 6.0.5 to version 6.0.6 or later.