CVE-2026-126663— Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag

Quick assessment

Affected

Contao Contao

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Contao 4.0.0 至 5.3.54 之前的版本、5.4.0 至 5.7.17 之前的版本，以及 6.0.0 至 6.0.6 之前的版本，均存在路径遍历漏洞。该漏洞允许内容编辑者通过插入标签读取文件系统中的任意图像文件。攻击者可嵌入经过百分号编码的序列（如），使其在未经处理前即可绕过的安全检查，从而利用前端图像缩放功能，将位于目录之外的图像文件进行读取并返回给用户。

CVSS 4.3 · Medium Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1083 · File and Directory Discovery

Affected Version Matrix 3

Vendor	Product	Version Range	Status
Contao	Contao	`4.0.0< 5.3.54`	affected
		`5.4.0-RC1< 5.7.17`	affected
		`6.0.0-RC1< 6.0.6`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag

Source: CVE Program / CVE List V5

Vulnerability Description

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

不正确的行为次序：规范化之前验证

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Contao	Contao	4.0.0 ~ 5.3.54	-

II. Public POCs for CVE-2026-126663

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126663

请登录查看更多情报信息。

Other References for CVE-2026-126663 (9)

https://github.com/contao/contao/commit/0f7989eb5b28d85dcd441ef22f80f8af4f56433e patch
https://github.com/contao/contao/blob/5.3.53/core-bundle/src/InsertTag/Resolver/LegacyInsertTag.php#L565-L582 technical-description
https://github.com/contao/contao/commit/e820e3c9d79a5c07f274558513c8db08a79bf804 patch
https://github.com/contao/contao/commit/688c0f6213afbd000cd22ad0a44555eca80b40ab patch
https://github.com/contao/contao/releases/tag/6.0.6 release-notes
https://github.com/contao/contao/releases/tag/5.3.54 release-notes
https://github.com/contao/contao/releases/tag/5.7.17 release-notes
https://github.com/contao/contao/security/advisories/GHSA-r7cf-mfp4-r23h vendor-advisory
https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-path-traversal-via-image-insert-tag third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126663

IV. Related Vulnerabilities

Same product: Contao

Same vendor: Contao

Same weakness: CWE-180