CVE-2026-107844 is a medium-severity (CVSS 5.3) Path Traversal vulnerability in contao/core-bundle. A fix is available for contao/core-bundle — see the affected versions and patch details below.
Contao: Path traversal in the images controller
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-107844.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-107844 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
contao/core-bundle🐘contao/core-bundleReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
ImagesController joins the user controlled {path} onto the configured image target directory with Path::join(), which canonicalises .. segments, and never calls Path::isBasePath() to confirm the result stayed inside that directory. An unauthenticated GET with percent encoded dot segments therefore escapes the directory and the file is returned by BinaryFileResponse. Reads are bounded to the extensions in contao.image.valid_extensions, and paths below the upload directory fail for an unrelated reason, so this is reported as a missing boundary check rather than as a general arbitrary file read. Both Apache with the shipped public/.htaccess and nginx with the documented configuration are affected.
Impact
Any unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of contao.image.valid_extensions (jpg, jpeg, gif, png, tif, tiff, bmp, svg, svgz, webp). The route also acts as an existence oracle for arbitrary paths, and on a debug enabled instance the 404 message discloses the absolute filesystem path.
Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside files/.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | contao/core-bundle | ≥ 4.1.0&&< 5.3.50 | 5.3.50composer require contao/core-bundle:^5.3.50 |
| 🐘Packagist | contao/core-bundle | ≥ 5.4.0-RC1&&< 5.7.12 | 5.7.12composer require contao/core-bundle:^5.7.12 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for contao/core-bundle, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update contao/core-bundle to 5.3.50 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-107844 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
Frequently Asked Questions
Is CVE-2026-107844 in your dependencies?
Find it across Packagist, including transitive dependencies.