CVE-2026-126662

Contao: Mehrere Schwachstellen

Open Source Contao

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.

11. Nov 2026

Ausgewertete Quellen

• CERT-Bund
  WID-SEC-2026-4516
• NVD
  CVE-2026-126662