Executive brief
Contao, an open-source content management system, contains a vulnerability in its job attachment handling. An authorized backend user could potentially access files belonging to other jobs that they are not permitted to see. This could lead to the exposure of sensitive information such as crawl logs, URLs, and error messages.
Technical details
A path traversal vulnerability exists in the JobsController::downloadJobAttachment() function of Contao. While the controller validates access to a specific job UUID, it fails to sanitize the 'identifier' parameter used to locate attachments. An attacker can use '../' segments in the identifier to bypass the intended directory boundary, as the VirtualFilesystem::resolve() method canonicalizes the path without ensuring it remains within the authorized job's subdirectory. This allows cross-job authorization bypass for known attachment paths (e.g., debug_log.csv). The vulnerability is mitigated by the use of UUID v4 for job directories, making brute-force attacks difficult. The issue is fixed in version 5.7.7.
Affected products
- Contao contao/contao >= 5.7.0, < 5.7.7
- Contao contao/core-bundle >= 5.7.0, < 5.7.7
Timeline
- 2026-06-15: disclosed
- 2026-07-31: advisory: NVD publication date
- 2026-08-06: patched: GitHub Advisory published/updated date