CVE-2026-126662

Description

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.

References

• https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folder.php#L1716-L1720
• https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70
• https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66
• https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900
• https://github.com/contao/contao/releases/tag/5.3.54