{"id":"CVE-2026-107844","aliases":["GHSA-mrvp-7wmx-5m4h"],"url":"https://o3.security/vulnerability/CVE-2026-107844","summary":"Contao: Path traversal in the images controller","details":"`ImagesController` joins the user controlled `{path}` onto the configured image target directory with `Path::join()`, which canonicalises `..` segments, and never calls `Path::isBasePath()` to confirm the result stayed inside that directory. An unauthenticated GET with percent encoded dot segments therefore escapes the directory and the file is returned by `BinaryFileResponse`. Reads are bounded to the extensions in `contao.image.valid_extensions`, and paths below the upload directory fail for an unrelated reason, so this is reported as a missing boundary check rather than as a general arbitrary file read. Both Apache with the shipped `public/.htaccess` and nginx with the documented configuration are affected.\n\n### Impact\n\nAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of `contao.image.valid_extensions` (`jpg`, `jpeg`, `gif`, `png`, `tif`, `tiff`, `bmp`, `svg`, `svgz`, `webp`). The route also acts as an existence oracle for arbitrary paths, and on a debug enabled instance the 404 message discloses the absolute filesystem path.\n\n**Honesty caveat, stated because it lowers the severity.** The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside `files/`.","published":"2026-10-09T19:24:02.625Z","modified":"2026-10-24T02:30:49.788527758Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"contao/core-bundle","fixedVersion":"5.3.50"},{"ecosystem":"Packagist","name":"contao/core-bundle","fixedVersion":"5.7.12"}],"fix":{"url":"https://github.com/contao/contao/commit/867c055122fdf12220f973f862082037b695b9bd","label":"contao/contao@867c055"},"references":[{"type":"WEB","url":"https://github.com/contao/contao/releases/tag/5.3.50"},{"type":"WEB","url":"https://github.com/contao/contao/releases/tag/5.7.12"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107844.json"},{"type":"ADVISORY","url":"https://github.com/contao/contao/security/advisories/GHSA-mrvp-7wmx-5m4h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107844"},{"type":"FIX","url":"https://github.com/contao/contao/commit/867c055122fdf12220f973f862082037b695b9bd"},{"type":"PACKAGE","url":"https://github.com/contao/contao"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:30:49.788527758Z"}}