# CVE-2026-55825: Contao path traversal in job attachment downloads

Source: https://junglewise.ai/threats/cve-2026-55825-contao-path-traversal-in-job-attachment-downloads  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-08-06  
License: CC BY 4.0 with a link back

CVE-2026-55825 · Severity: low · CVSS 3.1 · Published 2026-07-31

Contao, an open-source content management system, contains a vulnerability in its job attachment handling. An authorized backend user could potentially access files belonging to other jobs that they are not permitted to see. This could lead to the exposure of sensitive information such as crawl logs, URLs, and error messages.

Technologies: [Contao](https://junglewise.ai/threats/technologies/contao), [Contao Core Bundle](https://junglewise.ai/threats/technologies/core-bundle), [contao/contao (Packagist)](https://junglewise.ai/threats/technologies/contao-contao), [contao/core-bundle (Packagist)](https://junglewise.ai/threats/technologies/contao-core-bundle). Vendors: [Contao](https://junglewise.ai/threats/vendors/contao), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55825 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55825 being exploited in the wild.

**How severe is CVE-2026-55825?** Low severity, with a CVSS score of 3.1, published 31 July 2026.

**Which products and versions are affected?** Contao >= 5.7.0, < 5.7.7, 5.7.0 through 5.7.6; Contao Core Bundle >= 5.7.0, < 5.7.7; contao/contao (Packagist) >= 5.7.0, < 5.7.7, ECOSYSTEM:introduced=5.7.0,fixed=5.7.7; contao/core-bundle (Packagist) >= 5.7.0, < 5.7.7, ECOSYSTEM:introduced=5.7.0,fixed=5.7.7.

**Is there a fix for CVE-2026-55825?** Yes. contao/contao (Packagist): upgrade to 5.7.7 or later; contao/core-bundle (Packagist): upgrade to 5.7.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55825 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55825?** Check whether you run Contao, Contao Core Bundle, contao/contao (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- contao/contao (Packagist): upgrade to 5.7.7 or later

  ```sh
  composer require contao/contao:^5.7.7
  ```

- contao/core-bundle (Packagist): upgrade to 5.7.7 or later

  ```sh
  composer require contao/core-bundle:^5.7.7
  ```


## Technical details

A path traversal vulnerability exists in the JobsController::downloadJobAttachment() function of Contao. While the controller validates access to a specific job UUID, it fails to sanitize the 'identifier' parameter used to locate attachments. An attacker can use '../' segments in the identifier to bypass the intended directory boundary, as the VirtualFilesystem::resolve() method canonicalizes the path without ensuring it remains within the authorized job's subdirectory. This allows cross-job authorization bypass for known attachment paths (e.g., debug_log.csv). The vulnerability is mitigated by the use of UUID v4 for job directories, making brute-force attacks difficult. The issue is fixed in version 5.7.7.

## Affected products

- Contao contao/contao >= 5.7.0, < 5.7.7
- Contao contao/core-bundle >= 5.7.0, < 5.7.7

## Identifiers

- CVE-2026-55825
- GHSA-grm4-wm43-9jh5

## Timeline

- 2026-06-15: disclosed
- 2026-07-31: advisory: NVD publication date
- 2026-08-06: patched: GitHub Advisory published/updated date

## References

- [https://api.github.com/users/0x1saac](https://api.github.com/users/0x1saac)
- [https://github.com/0x1saac](https://github.com/0x1saac)
- [https://api.github.com/users/0x1saac/gists%7B/gist_id%7D](https://api.github.com/users/0x1saac/gists%7B/gist_id%7D)
- [https://api.github.com/users/0x1saac/repos](https://api.github.com/users/0x1saac/repos)
- [https://avatars.githubusercontent.com/u/182232496?v=4](https://avatars.githubusercontent.com/u/182232496?v=4)
- [https://api.github.com/users/0x1saac/events%7B/privacy%7D](https://api.github.com/users/0x1saac/events%7B/privacy%7D)

## Related threats

- [Contao path traversal in image insert tag](https://junglewise.ai/threats/cve-2026-126663-contao-4-0-0-before-5-3-54-5-4-0-before-5-7-17-and-6-0-0-before)
- [Contao access control bypass in file manager Edit-Multiple](https://junglewise.ai/threats/cve-2026-126662-contao-4-0-0-before-5-3-54-5-4-0-before-5-7-17-and-6-0-0-before)
- [Contao improper access control in table access voter](https://junglewise.ai/threats/cve-2026-107851-contao-improper-access-control-in-the-table-access-voter)
- [Contao improper access control in preview links module](https://junglewise.ai/threats/cve-2026-107850-contao-improper-access-control-in-the-preview-links-module)
- [Contao: Cross-site request forgery in custom backend actions](https://junglewise.ai/threats/cve-2026-107848-contao-cross-site-request-forgery-in-custom-backend-actions)