CVE-2026-126663: Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs content-editor privileges in Contao. They can place a crafted {{image::}} insert tag containing percent-encoded traversal sequences such as ..%2f.
What data can be exposed?
The issue can expose image files readable by the Contao process that are located outside the intended files directory. The frontend resize functionality then serves the selected file.
Which deployments are affected?
Affected versions are Contao 4.0.0 through before 5.3.54, 5.4.0 through before 5.7.17, and 6.0.0 through before 6.0.6. The described attack uses the {{image::}} insert tag and does not require user interaction.
How can I remediate the issue?
Upgrade to Contao 5.3.54, 5.7.17, or 6.0.6, as appropriate for the deployed release branch. Until upgraded, restrict content-editor access because those users can supply the malicious insert tag.