{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126662", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-11T12:03:56.584Z", "datePublished": "2026-11-11T12:24:37.304Z", "dateUpdated": "2026-11-11T12:24:37.304Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-11T12:24:37.304Z"}, "datePublic": "2026-11-11T07:15:05.000Z", "title": "Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple", "descriptions": [{"lang": "en", "value": "Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "affected": [{"vendor": "Contao", "product": "Contao", "defaultStatus": "unaffected", "versions": [{"version": "4.0.0", "lessThan": "5.3.54", "status": "affected", "versionType": "semver"}, {"version": "5.4.0-RC1", "lessThan": "5.7.17", "status": "affected", "versionType": "semver"}, {"version": "6.0.0-RC1", "lessThan": "6.0.6", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:composer/contao/core-bundle", "repo": "https://github.com/contao/contao"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "5.3.54"}, {"vulnerable": true, "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.0-rc1", "versionEndExcluding": "5.7.17"}, {"vulnerable": true, "criteria": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0-rc1", "versionEndExcluding": "6.0.6"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-9jfh-v443-w3fj)"}, {"url": "https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900", "tags": ["patch"]}, {"url": "https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66", "tags": ["patch"]}, {"url": "https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70", "tags": ["patch"]}, {"url": "https://github.com/contao/contao/releases/tag/5.3.54", "tags": ["release-notes"], "name": "Contao 5.3.54 Release Notes"}, {"url": "https://github.com/contao/contao/releases/tag/5.7.17", "tags": ["release-notes"], "name": "Contao 5.7.17 Release Notes"}, {"url": "https://github.com/contao/contao/releases/tag/6.0.6", "tags": ["release-notes"], "name": "Contao 6.0.6 Release Notes"}, {"url": "https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folder.php#L1716-L1720", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiple"}], "credits": [{"lang": "en", "value": "AlpetGexha", "type": "finder"}, {"lang": "en", "value": "ausi", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:composer/contao/core-bundle", "product": "Contao", "repo": "https://github.com/contao/contao", "vendor": "Contao", "versions": [{"lessThan": "5.3.54", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "5.7.17", "status": "affected", "version": "5.4.0-RC1", "versionType": "semver"}, {"lessThan": "6.0.6", "status": "affected", "version": "6.0.0-RC1", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download."}], "id": "CVE-2026-126662", "lastModified": "2026-11-11T13:17:24.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-11T13:17:24.337", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folder.php#L1716-L1720"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/contao/contao/releases/tag/5.3.54"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/contao/contao/releases/tag/5.7.17"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/contao/contao/releases/tag/6.0.6"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiple"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{}