CVE-2026-107844

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107844
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107844.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107844
Aliases
Published
2026-10-09T19:24:02Z
Modified
2026-10-10T10:45:14Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Contao: Path traversal in the images controller
Details

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBasePath() to verify that the canonical path remains inside that directory. An unauthenticated request containing encoded parent-directory segments can therefore return files under the project directory through BinaryFileResponse when their names use an extension allowed by contao.image.valid_extensions. The route can also reveal whether arbitrary paths exist, and debug responses can disclose absolute filesystem paths, but paths below the upload directory were not shown to be readable. This issue is fixed in versions 5.3.50 and 5.7.12.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107844.json"
}
References

Affected packages

Git / github.com/contao/contao

Affected ranges

Type
GIT
Repo
https://github.com/contao/contao
Events
Introduced
8cb541c59cb07ecb62fc5c5685c6448f38b97ad8
Fixed
a11109b60dedcbd99e32a4e8550afdadb500f2c5
Introduced
c5e3841e5107ab36ae2bf7795fb8d51d3d30f88b
Fixed
a6543f49a92187a7368f51b290179c4795386e23
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.3.50"
        },
        {
            "introduced": "5.4.0-RC1"
        },
        {
            "fixed": "5.7.12"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107844.json"