CVE-2026-55825: Contao path traversal in job attachment downloads

CVE-2026-55825 · Severity: low · CVSS 3.1 · Published 2026-07-31

Contao, an open-source content management system, contains a vulnerability in its job attachment handling. An authorized backend user could potentially access files belonging to other jobs that they are not permitted to see. This could lead to the exposure of sensitive information such as crawl logs, URLs, and error messages.

Technologies: Contao, Contao Core Bundle, contao/contao (Packagist), contao/core-bundle (Packagist). Vendors: Contao, Packagist.

Quick answers

Is CVE-2026-55825 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55825 being exploited in the wild.
How severe is CVE-2026-55825?
Low severity, with a CVSS score of 3.1, published 31 July 2026.
Which products and versions are affected?
Contao >= 5.7.0, < 5.7.7, 5.7.0 through 5.7.6; Contao Core Bundle >= 5.7.0, < 5.7.7; contao/contao (Packagist) >= 5.7.0, < 5.7.7, ECOSYSTEM:introduced=5.7.0,fixed=5.7.7; contao/core-bundle (Packagist) >= 5.7.0, < 5.7.7, ECOSYSTEM:introduced=5.7.0,fixed=5.7.7.
Is there a fix for CVE-2026-55825?
Yes. contao/contao (Packagist): upgrade to 5.7.7 or later; contao/core-bundle (Packagist): upgrade to 5.7.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55825 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55825?
Check whether you run Contao, Contao Core Bundle, contao/contao (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • contao/contao (Packagist): upgrade to 5.7.7 or later
    composer require contao/contao:^5.7.7
  • contao/core-bundle (Packagist): upgrade to 5.7.7 or later
    composer require contao/core-bundle:^5.7.7

Technical details

A path traversal vulnerability exists in the JobsController::downloadJobAttachment() function of Contao. While the controller validates access to a specific job UUID, it fails to sanitize the 'identifier' parameter used to locate attachments. An attacker can use '../' segments in the identifier to bypass the intended directory boundary, as the VirtualFilesystem::resolve() method canonicalizes the path without ensuring it remains within the authorized job's subdirectory. This allows cross-job authorization bypass for known attachment paths (e.g., debug_log.csv). The vulnerability is mitigated by the use of UUID v4 for job directories, making brute-force attacks difficult. The issue is fixed in version 5.7.7.

Affected products

  • Contao contao/contao >= 5.7.0, < 5.7.7
  • Contao contao/core-bundle >= 5.7.0, < 5.7.7

Identifiers

  • CVE-2026-55825
  • GHSA-grm4-wm43-9jh5

Timeline

  • 2026-06-15: disclosed
  • 2026-07-31: advisory: NVD publication date
  • 2026-08-06: patched: GitHub Advisory published/updated date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.