Cross-Job Authorization Bypass in Contao Open Source CMS
CVE-2026-55825

3.1LOW

Key Information:

Vendor

Contao

Status
Contao
Vendor
CVE Published:
31 July 2026

What is CVE-2026-55825?

The vulnerability in Contao CMS allows an authenticated backend user to exploit job attachment endpoints by manipulating attachment identifiers. By providing an identifier that contains '../' segments, the attacker can access files from different job directories located in 'var/job-attachments'. The vulnerability arises due to inadequate authorization checks, permitting the combination of authorized job UUIDs with user-controlled identifiers. This could lead to unauthorized file access, exposing sensitive information from other job attachments. The risk is heightened in environments where sensitive job data is stored, necessitating immediate attention for vulnerable versions.

Affected Version(s)

contao >= 5.7.0, < 5.7.7

References

https://github.com/contao/contao/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.