CVE-2026-126662: Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 5.3.54 - Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 5.7.17 - Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 6.0.6
Event History
Frequently Asked Questions
Which backend users are exposed to this issue?
The issue affects backend users whose file access is restricted by filemounts and who also have permission to the protected or syncExclude field. Those permissions allow the user to use the file manager's Edit-Multiple operation against folders outside their assigned filemount.
What must an attacker be able to do to exploit it?
An attacker needs backend access as a filemount-restricted user and permission to modify the protected or syncExclude field. They can then submit paths to outside folders through the IDS parameter in the Edit-Multiple operation.
What is the potential impact of exploitation?
An attacker can publish protected folders or exclude folders from DBAFS synchronization. Publishing protected folders can expose their files for public download.
Which versions need remediation?
Affected releases are Contao 4.0.0 through versions before 5.3.54, 5.4.0 through versions before 5.7.17, and 6.0.0 through versions before 6.0.6. Upgrade to 5.3.54, 5.7.17, 6.0.6, or a later applicable release.
What can be done if an upgrade cannot be applied immediately?
Restrict the protected and syncExclude field permissions for filemount-restricted backend users, particularly users who do not need to manage folder publication or DBAFS synchronization. Review use of the file manager Edit-Multiple operation for unexpected outside-folder paths in the IDS parameter.