Contao: Access control bypass in file manager Edit-Multiple

Summary

Contao CMS versions before 5.3.54, 5.7.17 and 6.0.6 allow back-end users with restricted file mounts to change folders outside their mount via the file manager's Edit-Multiple operation. An attacker with the protected or syncExclude permission can submit outside folder paths to publish protected folders or exclude them from DBAFS synchronization. This can expose files to public download. A valid back-end account with these permissions is required.

Affected

• Contao 4.0.0 before 5.3.54
• Contao 5.4.0-RC1 before 5.7.17
• Contao 6.0.0-RC1 before 6.0.6
• Contao 4.x: whether the 4.x line receives this fix is unknown.

Fixed in

• Contao 5.3.54
• Contao 5.7.17
• Contao 6.0.6

Workaround

Unknown.

Exploitation

• Not known to be exploited in the wild.
• No public proof of concept found at the time of writing.

Our recommendation

• Update Contao to 5.3.54, 5.7.17 or 6.0.6 (or later) in the next maintenance window; prioritise sites with several back-end editors.
• Until patched, review back-end users with the protected or syncExclude permissions and restrict them where not needed.
• Check whether folders outside users' file mounts have been published or excluded from DBAFS sync.
• Check the vendor advisory GHSA-9jfh-v443-w3fj for updates on 4.x.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-9jfh-v443-w3fj github.com
• Contao release 5.3.54 github.com
• Contao release 5.7.17 github.com
• Contao release 6.0.6 github.com
• Fix commit 240e169 github.com
• VulnCheck advisory www.vulncheck.com
• CVE Record CVE-2026-126662 www.cve.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:23.