CVE-2026-107844 Details

A path traversal vulnerability has been identified in Contao versions 5.0.0 prior to 5.3.50 and 5.7.12. The issue arises in the ImagesController, where the user-controlled {path} parameter is joined to the target directory using Path::join(). However, it fails to verify that the resulting canonical path remains within the directory boundaries. This oversight allows an unauthenticated request with encoded parent-directory segments to access files outside the intended directory, specifically under the project directory, as long as the file extension is one of the valid image types recognized by Contao. The vulnerability can also be exploited to check the existence of arbitrary paths, with debug responses revealing absolute filesystem locations. Notably, while the route can access files with certain extensions outside the upload directory, it cannot read protected member folders due to a different issue.

Users can upgrade to Contao versions 5.3.50 or 5.7.12 to address this vulnerability.