High severity7.1NVD Advisory· Published Nov 11, 2026· Updated Nov 11, 2026
CVE-2026-126662
CVE-2026-126662
Description
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
9- github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folder.phpnvd
- github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70nvd
- github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66nvd
- github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900nvd
- github.com/contao/contao/releases/tag/5.3.54nvd
- github.com/contao/contao/releases/tag/5.7.17nvd
- github.com/contao/contao/releases/tag/6.0.6nvd
- github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fjnvd
- www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiplenvd
News mentions
0No linked articles in our index yet.