CVE-2026-126662— Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple

Quick assessment

Affected

Contao Contao

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Contao 4.0.0 至 5.3.54 之前的版本、5.4.0 至 5.7.17 之前的版本，以及 6.0.0 至 6.0.6 之前的版本存在访问控制绕过漏洞。该漏洞允许受文件挂载（filemount）限制的后端用户，通过文件管理器中的“批量编辑”（Edit-Multiple）操作，修改其文件挂载范围之外的文件夹。拥有 protected 或 syncExclude 字段权限的攻击者，可在 IDS 参数中提交外部文件夹路径，从而发布受保护文件夹或将其排除在 DBAFS 同步之外，导致文件暴露并可供公开下载。

CVSS 7.1 · High Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1566 · Phishing T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 3

Vendor	Product	Version Range	Status
Contao	Contao	`4.0.0< 5.3.54`	affected
		`5.4.0-RC1< 5.7.17`	affected
		`6.0.0-RC1< 6.0.6`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple

Source: CVE Program / CVE List V5

Vulnerability Description

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Contao	Contao	4.0.0 ~ 5.3.54	-

II. Public POCs for CVE-2026-126662

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126662

请登录查看更多情报信息。

Other References for CVE-2026-126662 (9)

https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70 patch
https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folder.php#L1716-L1720 technical-description
https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900 patch
https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66 patch
https://github.com/contao/contao/releases/tag/6.0.6 release-notes
https://github.com/contao/contao/releases/tag/5.3.54 release-notes
https://github.com/contao/contao/releases/tag/5.7.17 release-notes
https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj vendor-advisory
https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiple third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126662

IV. Related Vulnerabilities

Same product: Contao

Same vendor: Contao

Same weakness: CWE-862