CVE-2026-126663

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126663
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126663.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126663
Aliases
  • GHSA-r7cf-mfp4-r23h
Published
2026-11-11T12:24:38Z
Modified
2026-11-12T02:48:36Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag
Details

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-180"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126663.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "4.0.0"
                        },
                        {
                            "fixed": "5.3.54"
                        },
                        {
                            "introduced": "5.4.0-RC1"
                        },
                        {
                            "fixed": "5.7.17"
                        },
                        {
                            "introduced": "6.0.0-RC1"
                        },
                        {
                            "fixed": "6.0.6"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "4.0.0"
                        },
                        {
                            "fixed": "5.3.54"
                        },
                        {
                            "introduced": "5.4.0-rc1"
                        },
                        {
                            "fixed": "5.7.17"
                        },
                        {
                            "introduced": "6.0.0-rc1"
                        },
                        {
                            "fixed": "6.0.6"
                        }
                    ],
                    "source": "CPE_FIELD",
                    "strategy": "CPEApplicability"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "4.0.0"
                        },
                        {
                            "fixed": "5.3.54"
                        },
                        {
                            "introduced": "5.4.0"
                        },
                        {
                            "fixed": "5.7.17"
                        },
                        {
                            "introduced": "6.0.0"
                        },
                        {
                            "fixed": "6.0.6"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/contao/contao

Affected ranges

Type
GIT
Repo
https://github.com/contao/contao
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
688c0f6213afbd000cd22ad0a44555eca80b40ab
Fixed
0f7989eb5b28d85dcd441ef22f80f8af4f56433e
Fixed
e820e3c9d79a5c07f274558513c8db08a79bf804
Fixed
4b4b69a14eb32775caf7ea3b15a38af6a38a85e7
Fixed
1ef9c449fecbac9bba7b107b016f0874148b8fd9
Fixed
76ddadae9056acafc478be26426e555f3c66546e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "688c0f6213afbd000cd22ad0a44555eca80b40ab"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "0f7989eb5b28d85dcd441ef22f80f8af4f56433e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "e820e3c9d79a5c07f274558513c8db08a79bf804"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "5.3.54",
            "range": [
                {
                    "fixed": "4b4b69a14eb32775caf7ea3b15a38af6a38a85e7"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "5.7.17",
            "range": [
                {
                    "fixed": "1ef9c449fecbac9bba7b107b016f0874148b8fd9"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "6.0.6",
            "range": [
                {
                    "fixed": "76ddadae9056acafc478be26426e555f3c66546e"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

5.*
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.50
5.3.51
5.3.52
5.3.53
5.3.6
5.3.7
5.3.8
5.3.9
5.6.0-RC1
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.12
5.7.13
5.7.14
5.7.15
5.7.16
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
6.*
6.0.0
6.0.0-RC1
6.0.0-RC2
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126663.json"