Contao CMS CVE-2026-55825

Exploitation requires an active, authenticated Contao backend session - the attacker must be a registered backend user with at minimum access to one job record; unauthenticated or frontend-only users cannot exploit this. The attacker must also independently know the UUID v4 identifier of the target victim job directory, as the description explicitly confirms that brute-force against unknown UUIDs is not practical (122-bit random space). The vulnerability is confined to the job attachment download endpoint and can only expose files stored within the var/job-attachments virtual filesystem mount - files outside this mount are unreachable. Limiting factors: (1) backend authentication required (PR:L); (2) victim job UUID must be known in advance (AC:H); (3) impact is bounded to the job-attachments filesystem namespace with no integrity or availability consequences.

The CVSS 3.1 base score of 3.1 (Low) is consistent with the actual threat model: the attack vector is network (AV:N) but complexity is High (AC:H) because the attacker must know the UUID v4 identifier of a victim job - a 122-bit random value that is not practically brute-forceable. Low privileges (PR:L) are required, meaning an unauthenticated actor cannot exploit this. The confidentiality impact is Low (C:L), restricted to files stored in var/job-attachments; there is no integrity or availability impact. No EPSS data was provided in the available intelligence, so exploitation probability cannot be quantified numerically. There is no CISA KEV listing and no known public exploit, making this a theoretical risk rather than an operationally observed threat. The realistic concern is a malicious insider or a compromised backend account performing horizontal privilege escalation to access another job's attachment files. This is not a remote-unauthenticated critical flaw - defenders with controlled backend user rosters face minimal exposure.

An authenticated Contao backend user with legitimate access to their own job crafts an attachment download request, replacing the normal attachment identifier with a traversal string such as ../victim-job-uuid/debug_log.csv. The controller validates the request against the attacker's own job UUID and passes authorization, then resolves the combined path to victim-job-uuid/debug_log.csv within the var/job-attachments mount. The attacker receives the victim job's attachment file without authorization, enabling horizontal data exfiltration across job records within the same Contao installation.