{"uuid": "95e0919e-5722-4a15-983c-96fa799545b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107844", "type": "seen", "source": "https://gist.github.com/alon710/ec24866e662fce0f18f2e8e0c0e13ac0", "content": "# CVE-2026-107844: CVE-2026-107844: Path Traversal Vulnerability in Contao ImagesController\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-10-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107844\n\n## Summary\nA path traversal vulnerability (CWE-22) in Contao CMS allows unauthenticated remote attackers to bypass directory boundary restrictions in ImagesController and access files within the project directory.\n\n## TL;DR\nUnauthenticated path traversal in Contao ImagesController permits arbitrary reading of localized files matching allowed extensions and system directory probing.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n- **Attack Vector**: Network (Unauthenticated HTTP/HTTPS GET requests)\n- **EPSS Score**: 0.00312 (22.18th percentile)\n- **Impact**: Partial Information Disclosure / Local File Enumeration\n- **Exploit Status**: Proof of Concept / Public Commit Diffs Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Contao CMS 5.0.0 through 5.3.49\n- Contao CMS 5.4.0-RC1 through 5.7.11\n- **Contao CMS**: >= 5.0.0, < 5.3.50 (Fixed in: `5.3.50`)\n- **Contao CMS**: >= 5.4.0-RC1, < 5.7.12 (Fixed in: `5.7.12`)\n\n## Mitigation\n\n- Upgrade Contao CMS dependencies to fixed maintenance releases 5.3.50 or 5.7.12.\n- Enforce Web Application Firewall (WAF) filtering on HTTP request URI parameters for path traversal sequences.\n- Restrict 'contao.image.valid_extensions' configuration to essential image asset types only.\n- Disable application debug mode in production deployment environments to avoid absolute path disclosure.\n\n**Remediation Steps:**\n1. Run 'composer update contao/contao --with-dependencies' in project root environments.\n2. Verify that contao package versions resolved match >= 5.3.50 or >= 5.7.12.\n3. Clear Symfony application caches using 'php vendor/bin/contao-console cache:clear'.\n4. Execute automated or unit tests against ImagesController routes to confirm traversal attempts return HTTP 404.\n\n## References\n\n- [Contao Security Advisory GHSA-mrvp-7wmx-5m4h](https://github.com/contao/contao/security/advisories/GHSA-mrvp-7wmx-5m4h)\n- [Contao Security Fix Commit 867c055122fdf12220f973f862082037b695b9bd](https://github.com/contao/contao/commit/867c055122fdf12220f973f862082037b695b9bd)\n- [Contao Release Notes 5.3.50](https://github.com/contao/contao/releases/tag/5.3.50)\n- [Contao Release Notes 5.7.12](https://github.com/contao/contao/releases/tag/5.7.12)\n- [NVD Vulnerability Detail CVE-2026-107844](https://nvd.nist.gov/vuln/detail/CVE-2026-107844)\n- [CVE Program Record CVE-2026-107844](https://www.cve.org/CVERecord?id=CVE-2026-107844)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107844) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-10T22:30:30.000000Z"}