{"id":"CVE-2026-126663","summary":"Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag","details":"Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory.","aliases":["GHSA-r7cf-mfp4-r23h"],"modified":"2026-11-12T02:48:36.057635868Z","published":"2026-11-11T12:24:38.010Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126663.json","unresolved_ranges":[{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"4.0.0"},{"fixed":"5.3.54"},{"introduced":"5.4.0-RC1"},{"fixed":"5.7.17"},{"introduced":"6.0.0-RC1"},{"fixed":"6.0.6"}],"source":"AFFECTED_FIELD"}]},{"extracted_events":[{"strategy":"CPEApplicability","range":[{"introduced":"4.0.0"},{"fixed":"5.3.54"},{"introduced":"5.4.0-rc1"},{"fixed":"5.7.17"},{"introduced":"6.0.0-rc1"},{"fixed":"6.0.6"}],"source":"CPE_FIELD"}]},{"extracted_events":[{"range":[{"introduced":"4.0.0"},{"fixed":"5.3.54"},{"introduced":"5.4.0"},{"fixed":"5.7.17"},{"introduced":"6.0.0"},{"fixed":"6.0.6"}],"source":"DESCRIPTION"}]}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-180"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126663.json"},{"type":"PACKAGE","url":"https://github.com/contao/contao"},{"type":"ARTICLE","url":"https://github.com/contao/contao/blob/5.3.53/core-bundle/src/InsertTag/Resolver/LegacyInsertTag.php#L565-L582"},{"type":"FIX","url":"https://github.com/contao/contao/commit/0f7989eb5b28d85dcd441ef22f80f8af4f56433e"},{"type":"FIX","url":"https://github.com/contao/contao/commit/688c0f6213afbd000cd22ad0a44555eca80b40ab"},{"type":"FIX","url":"https://github.com/contao/contao/commit/e820e3c9d79a5c07f274558513c8db08a79bf804"},{"type":"ADVISORY","url":"https://github.com/contao/contao/releases/tag/5.3.54"},{"type":"ADVISORY","url":"https://github.com/contao/contao/releases/tag/5.7.17"},{"type":"ADVISORY","url":"https://github.com/contao/contao/releases/tag/6.0.6"},{"type":"ADVISORY","url":"https://github.com/contao/contao/security/advisories/GHSA-r7cf-mfp4-r23h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126663"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-path-traversal-via-image-insert-tag"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/contao/contao","events":[{"introduced":"0"},{"fixed":"688c0f6213afbd000cd22ad0a44555eca80b40ab"},{"fixed":"0f7989eb5b28d85dcd441ef22f80f8af4f56433e"},{"fixed":"e820e3c9d79a5c07f274558513c8db08a79bf804"},{"fixed":"4b4b69a14eb32775caf7ea3b15a38af6a38a85e7"},{"fixed":"1ef9c449fecbac9bba7b107b016f0874148b8fd9"},{"fixed":"76ddadae9056acafc478be26426e555f3c66546e"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"688c0f6213afbd000cd22ad0a44555eca80b40ab"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"0f7989eb5b28d85dcd441ef22f80f8af4f56433e"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"e820e3c9d79a5c07f274558513c8db08a79bf804"}],"source":"REFERENCES_COMMIT"},{"original_tag":"5.3.54","range":[{"fixed":"4b4b69a14eb32775caf7ea3b15a38af6a38a85e7"}],"source":"REFERENCES_TAG"},{"range":[{"fixed":"1ef9c449fecbac9bba7b107b016f0874148b8fd9"}],"source":"REFERENCES_TAG","original_tag":"5.7.17"},{"range":[{"fixed":"76ddadae9056acafc478be26426e555f3c66546e"}],"source":"REFERENCES_TAG","original_tag":"6.0.6"}]}}],"versions":["5.3.53","5.7.16","6.0.5","5.7.15","6.0.4","5.3.52","6.0.3","5.7.14","6.0.2","6.0.1","5.7.13","5.3.51","6.0.0","5.3.50","5.7.12","5.7.11","5.3.49","5.7.10","6.0.0-RC2","6.0.0-RC1","5.3.48","5.7.9","5.7.8","5.7.7","5.3.47","5.7.6","5.7.5","5.3.46","5.7.4","5.7.3","5.3.45","5.7.2","5.7.1","5.7.0","5.7.0-RC4","5.7.0-RC3","5.7.0-RC2","5.7.0-RC1","5.3.44","5.3.43","5.3.42","5.3.41","5.3.40","5.3.39","5.3.38","5.3.37","5.3.36","5.3.35","5.6.0-RC1","5.3.34","5.3.33","5.3.32","5.3.31","5.3.30","5.3.29","5.3.28","5.3.27","5.3.26","5.3.25","5.3.24","5.3.23","5.3.22","5.3.21","5.3.20","5.3.19","5.3.18","5.3.17","5.3.16","5.3.15","5.3.14","5.3.13","5.3.12","5.3.11","5.3.10","5.3.9","5.3.8","5.3.7","5.3.6","5.3.5","5.3.4","5.3.3","5.3.2","5.3.1","5.3.0","5.3.0-RC4","5.3.0-RC3","5.3.0-RC2","5.3.0-RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126663.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}