Path Traversal Vulnerability in Contao by Contao GmbH & Co. KG

CVE-2026-126663

What is CVE-2026-126663?

The vulnerability allows content editors in Contao to exploit a path traversal flaw via the {{image::}} insert tag, enabling unauthorized access to image files throughout the filesystem. By embedding percent-encoded sequences like ..%2f, attackers can bypass security checks implemented by Validator::isInsecurePath() before the rawurldecode() function executes, potentially exposing sensitive images beyond the designated files directory, thereby increasing the risk of information disclosure.

References