CVE-2026-55825: Contao CMS Auth Bypass Vulnerability

CVE-2026-55825 Overview

CVE-2026-55825 is a path traversal vulnerability in Contao, an open-source content management system (CMS). The flaw affects Contao versions 5.7.0 through 5.7.6 and allows an authenticated backend user to read job attachment files belonging to other jobs. The job attachment download endpoint accepts an attacker-controlled attachment identifier that is concatenated with the authorized job UUID. Because VirtualFilesystem::resolve() canonicalizes the combined path before authorization is enforced on the target, ../ segments break out of the authorized job directory. This produces a cross-job authorization bypass restricted to known job attachment paths, categorized under [CWE-22].

Critical Impact
An authenticated backend user can read attachments from arbitrary known job directories under var/job-attachments, bypassing per-job authorization.

Affected Products

Contao CMS 5.7.0
Contao CMS versions 5.7.1 through 5.7.5
Contao CMS 5.7.6

Discovery Timeline

2026-07-31 - CVE-2026-55825 published to NVD
2026-08-01 - Last updated in NVD database

Technical Details for CVE-2026-55825

Vulnerability Analysis

The vulnerability resides in Contao's job attachment download controller. The controller authorizes only the jobUuid route parameter, verifying the calling user has access to that job. It then performs an attachment lookup that joins the authorized job UUID with an attachment identifier supplied by the request. The combined path is handed to the virtual filesystem for retrieval.

VirtualFilesystem::resolve() canonicalizes the entire path and rejects only paths that escape the filesystem mount root. It does not enforce containment within the authorized job directory. A request supplying authorized-job/../victim-job/debug_log.csv therefore resolves to victim-job/debug_log.csv inside var/job-attachments, and the response returns the victim job's file.

Exploitation requires knowledge of both the target job UUID and the attachment filename. Because Contao job directories use UUID v4 identifiers, brute-forcing unknown jobs is not practical. The impact is limited to disclosure of attachments in jobs whose paths are already known to the attacker.

Root Cause

The root cause is a missing containment check after path canonicalization. VirtualFilesystem::resolve() validates only the filesystem mount boundary, not the authorized subdirectory. The authorization performed on jobUuid does not extend to the final resolved path, breaking the assumption that the download endpoint reads only from within the authorized job directory.

Attack Vector

An authenticated backend user with access to at least one job issues a request to the job attachment download endpoint. The attacker sets jobUuid to a job they legitimately access and sets the attachment identifier to a value containing ../ segments followed by the target job UUID and filename. The virtual filesystem canonicalizes the joined path and returns the file from the victim job directory.

The vulnerability manifests entirely through the attachment identifier request parameter. Refer to the GitHub Security Advisory for technical details of the affected code paths.

Detection Methods for CVE-2026-55825

Indicators of Compromise

Backend HTTP requests to the job attachment download endpoint containing ../ or URL-encoded %2e%2e%2f sequences in the attachment identifier parameter.
Web server access logs showing repeated attachment downloads by a single authenticated user across attachment identifiers referencing multiple distinct job UUIDs.
Filesystem access events on var/job-attachments where the resolved job UUID differs from the jobUuid route parameter of the originating request.

Detection Strategies

Inspect Contao backend request logs for attachment identifiers that include path separators or traversal sequences; legitimate identifiers should not contain them.
Correlate authenticated backend user sessions with the set of job UUIDs each user is authorized to access, and flag downloads outside that set.
Deploy a web application firewall rule that decodes and normalizes the attachment identifier parameter before matching on ../ sequences.

Monitoring Recommendations

Enable verbose request logging on the Contao backend job attachment download route and forward logs to a centralized SIEM for retention and query.
Alert on 200-status responses where the attachment identifier parameter contains encoded or literal traversal tokens.
Baseline per-user job access volume and alert on sudden increases in unique job UUIDs referenced by attachment downloads.

How to Mitigate CVE-2026-55825

Immediate Actions Required

Upgrade Contao to a version later than 5.7.6 that contains the fix referenced in the GitHub Security Advisory.
Restrict Contao backend access to trusted users and enforce least privilege on job access assignments until patching completes.
Review web server and application logs for prior requests containing ../ in attachment identifier parameters.

Patch Information

Contao maintainers have published the fix through the GitHub Security Advisory GHSA-grm4-wm43-9jh5. Administrators should apply the vendor-supplied release that addresses versions 5.7.0 through 5.7.6. Confirm the deployed version reports a patched release string after upgrade.

Workarounds

Block requests to the job attachment download endpoint where the attachment identifier parameter contains ../, ..\, or their URL-encoded equivalents at the web application firewall.
Temporarily revoke backend job access from non-essential users until the patched release is deployed.
Restrict filesystem permissions on var/job-attachments subdirectories where feasible to limit read access by the PHP process user.

bash

# Example WAF rule (ModSecurity) blocking traversal in attachment identifier
SecRule ARGS:attachmentId "@rx (\.\./|\.\.\\|%2e%2e(%2f|%5c))" \
    "id:1055825,phase:2,deny,status:400,log,\
    msg:'CVE-2026-55825 Contao attachment path traversal blocked'"