Zurück zur CVE-Übersicht
CVE-2026-126662
HIGH(7.1)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Risk Signal Score28/100 — MITTEL
- CVSS 7.1 — Hoch
- Weniger als 24 Stunden alt
Beschreibung
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.
Referenzen
- https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folde...
- https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70
- https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66
- https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900
- https://github.com/contao/contao/releases/tag/5.3.54
- https://github.com/contao/contao/releases/tag/5.7.17
- https://github.com/contao/contao/releases/tag/6.0.6
- https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj
- https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7...