CVE-2026-55825

Name of the Vulnerable Software and Affected Versions Contao versions 5.7.0 through 5.7.6

Description An authenticated backend user with access to a specific job can perform a cross-job authorization bypass. By requesting an attachment identifier containing ../ segments, the user can force the job attachment download endpoint to read files from different job directories within var/job-attachments. This occurs because the controller only authorizes the jobUuid route parameter, and the subsequent lookup combines this authorized UUID with the attacker-controlled identifier. The VirtualFilesystem::resolve() function canonicalizes the path and only blocks attempts to escape the filesystem mount, allowing access to other job directories if the path is known. This is not practical for brute-forcing unknown jobs as directories use UUID v4 values.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.