CVE-2026-126662

HIGH 7.1

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.

CWE	CWE-862
Vendor	contao
Product	contao
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for contao contao

Be the first to know when new high vulnerabilities affecting contao contao are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

Contao / Contao

4.0.0 < 5.3.54 5.4.0-RC1 < 5.7.17 6.0.0-RC1 < 6.0.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

AlpetGexha ausi