{"id":"CVE-2026-126662","summary":"Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple","details":"Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.","aliases":["GHSA-9jfh-v443-w3fj"],"modified":"2026-11-12T02:48:35.174053032Z","published":"2026-11-11T12:24:37.304Z","database_specific":{"cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126662.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"4.0.0"},{"fixed":"5.3.54"},{"introduced":"5.4.0-RC1"},{"fixed":"5.7.17"},{"introduced":"6.0.0-RC1"},{"fixed":"6.0.6"}]}]},{"extracted_events":[{"strategy":"CPEApplicability","range":[{"introduced":"4.0.0"},{"fixed":"5.3.54"},{"introduced":"5.4.0-rc1"},{"fixed":"5.7.17"},{"introduced":"6.0.0-rc1"},{"fixed":"6.0.6"}],"source":"CPE_FIELD"}]},{"extracted_events":[{"source":"DESCRIPTION","range":[{"introduced":"4.0.0"},{"fixed":"5.3.54"},{"introduced":"5.4.0"},{"fixed":"5.7.17"},{"introduced":"6.0.0"},{"fixed":"6.0.6"}]}]}],"cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126662.json"},{"type":"PACKAGE","url":"https://github.com/contao/contao"},{"type":"ARTICLE","url":"https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folder.php#L1716-L1720"},{"type":"FIX","url":"https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70"},{"type":"FIX","url":"https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66"},{"type":"FIX","url":"https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900"},{"type":"ADVISORY","url":"https://github.com/contao/contao/releases/tag/5.3.54"},{"type":"ADVISORY","url":"https://github.com/contao/contao/releases/tag/5.7.17"},{"type":"ADVISORY","url":"https://github.com/contao/contao/releases/tag/6.0.6"},{"type":"ADVISORY","url":"https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126662"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiple"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/contao/contao","events":[{"introduced":"0"},{"fixed":"c01898f99c5d5af50a227ee85f27270c5427f900"},{"fixed":"a104202df2b532bb64805a0856fc94bb0bddbb66"},{"fixed":"240e169441796bb703819ee0e22728708f946b70"},{"fixed":"4b4b69a14eb32775caf7ea3b15a38af6a38a85e7"},{"fixed":"1ef9c449fecbac9bba7b107b016f0874148b8fd9"},{"fixed":"76ddadae9056acafc478be26426e555f3c66546e"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"c01898f99c5d5af50a227ee85f27270c5427f900"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"a104202df2b532bb64805a0856fc94bb0bddbb66"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"240e169441796bb703819ee0e22728708f946b70"}]},{"original_tag":"5.3.54","range":[{"fixed":"4b4b69a14eb32775caf7ea3b15a38af6a38a85e7"}],"source":"REFERENCES_TAG"},{"range":[{"fixed":"1ef9c449fecbac9bba7b107b016f0874148b8fd9"}],"source":"REFERENCES_TAG","original_tag":"5.7.17"},{"range":[{"fixed":"76ddadae9056acafc478be26426e555f3c66546e"}],"source":"REFERENCES_TAG","original_tag":"6.0.6"}]}}],"versions":["5.3.53","5.7.16","6.0.5","5.7.15","6.0.4","5.3.52","6.0.3","5.7.14","6.0.2","6.0.1","5.7.13","5.3.51","6.0.0","5.3.50","5.7.12","5.7.11","5.3.49","5.7.10","6.0.0-RC2","6.0.0-RC1","5.3.48","5.7.9","5.7.8","5.7.7","5.3.47","5.7.6","5.7.5","5.3.46","5.7.4","5.7.3","5.3.45","5.7.2","5.7.1","5.7.0","5.7.0-RC4","5.7.0-RC3","5.7.0-RC2","5.7.0-RC1","5.3.44","5.3.43","5.3.42","5.3.41","5.3.40","5.3.39","5.3.38","5.3.37","5.3.36","5.3.35","5.6.0-RC1","5.3.34","5.3.33","5.3.32","5.3.31","5.3.30","5.3.29","5.3.28","5.3.27","5.3.26","5.3.25","5.3.24","5.3.23","5.3.22","5.3.21","5.3.20","5.3.19","5.3.18","5.3.17","5.3.16","5.3.15","5.3.14","5.3.13","5.3.12","5.3.11","5.3.10","5.3.9","5.3.8","5.3.7","5.3.6","5.3.5","5.3.4","5.3.3","5.3.2","5.3.1","5.3.0","5.3.0-RC4","5.3.0-RC3","5.3.0-RC2","5.3.0-RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126662.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}]}