Contao CMS: Path traversal in image insert tag allows reading arbitrary image files
Summary
Contao CMS versions 4.0.0 to before 5.3.54, 5.4.0 to before 5.7.17 and 6.0.0 to before 6.0.6 contain a path traversal flaw in the {{image::}} insert tag. A logged-in content editor can use percent-encoded sequences such as ..%2f to bypass the path check, because the check runs before URL decoding. The frontend then resizes and serves image files stored outside the files directory, so an attacker can read any image the web server user can access. This is a confidentiality issue only and does not allow code execution.
Affected
- Contao 4.0.0 to before 5.3.54
- Contao 5.4.0-RC1 to before 5.7.17
- Contao 6.0.0-RC1 to before 6.0.6
- Default configuration: unaffected (according to the CVE record, the default is unaffected)
Fixed in
- Upgrade to Contao 5.3.54, 5.7.17 or 6.0.6, depending on the installed branch.
Workaround
Unknown.
- No vendor-published workaround found. Patching is the stated remedy.
Exploitation
- Not known to be exploited at the time of writing.
- No public proof of concept reported by the aggregators checked.
- The CVE was published on 11 Nov 2026, so this status may change quickly.
Our recommendation
- Upgrade Contao to 5.3.54, 5.7.17 or 6.0.6, prioritising public-facing sites and sites with many editor accounts.
- Review content-editor accounts now and remove those that are not needed until the upgrade is complete.
- Check the vendor advisory GHSA-r7cf-mfp4-r23h for final details.
- Upgrade any older 5.x installation as well, since a separate unauthenticated path traversal in the images controller was fixed in 5.3.50 and 5.7.12.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126663 www.cve.org
- GitHub Security Advisory GHSA-r7cf-mfp4-r23h github.com
- Contao 5.3.54 Release github.com
- Contao 5.7.17 Release github.com
- Contao 6.0.6 Release github.com
- Fix commit 0f7989eb github.com
- VulnCheck Advisory www.vulncheck.com
- Vulnerable code LegacyInsertTag.php (5.3.53) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:37.
Original description (NVD)
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory.
NVD references (9)
- https://github.com/contao/contao/blob/5.3.53/core-bundle/src/InsertTag/Resolver/LegacyInsertTag.php#L565-L582
- https://github.com/contao/contao/commit/0f7989eb5b28d85dcd441ef22f80f8af4f56433e
- https://github.com/contao/contao/commit/688c0f6213afbd000cd22ad0a44555eca80b40ab
- https://github.com/contao/contao/commit/e820e3c9d79a5c07f274558513c8db08a79bf804
- https://github.com/contao/contao/releases/tag/5.3.54
- https://github.com/contao/contao/releases/tag/5.7.17
- https://github.com/contao/contao/releases/tag/6.0.6
- https://github.com/contao/contao/security/advisories/GHSA-r7cf-mfp4-r23h
- https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-pa…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.