What is the CVSS score of CVE-2026-55825?

CVE-2026-55825 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-55825?

Yes, a patch is available for CVE-2026-55825. Update the affected software to the latest version immediately.

Contao CMS CVE-2026-55825

EUVD-2026-51620 LOW

Path Traversal (CWE-22)

2026-07-31 GitHub_M

GHSA-grm4-wm43-9jh5

Path Traversal Contao

3.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

PR:L because backend authentication is mandatory; AC:H because victim UUID v4 must be known; C:L as only job-attachment files within the mount are exposed.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 31, 2026 - 21:02 EUVD

Analysis Generated

Jul 31, 2026 - 20:18 vuln.today

DescriptionCVE.org

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. The later attachment lookup joins that authorized job UUID with the attacker-controlled identifier, then passes the combined path to the virtual filesystem. VirtualFilesystem::resolve() canonicalizes the whole path and only rejects paths that escape the filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes victim-job/debug_log.csv. This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values.

AnalysisAI

Cross-job file read in Contao CMS 5.7.0-5.7.6 allows authenticated backend users to exfiltrate job attachments belonging to other jobs by injecting path traversal sequences into the attachment identifier parameter. The job attachment download controller authorizes only the jobUuid route parameter, then constructs the actual file path by joining that authorized UUID with the attacker-supplied identifier; Contao's VirtualFilesystem::resolve() canonicalizes the combined path but rejects only escapes from the filesystem mount, not cross-job traversals within the mount. No public exploit has been identified at time of analysis, and the CVSS 3.1 Low score of 3.1 reflects meaningful exploitation barriers: backend authentication and prior knowledge of a victim job UUID are both required.

Technical ContextAI

The vulnerability affects Contao CMS 5.7.0-5.7.6 (CPE: cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*), an open-source PHP CMS. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). The job attachment download controller applies its authorization check exclusively to the jobUuid route parameter, then constructs the resolved file path by concatenating that authorized UUID with a separate, attacker-controlled attachment identifier. The combined string - e.g., authorized-job-uuid/../victim-job-uuid/debug_log.csv - is passed to VirtualFilesystem::resolve(), which canonicalizes the full path. Because the canonical result (victim-job-uuid/debug_log.csv) still falls within the var/job-attachments filesystem mount, VirtualFilesystem::resolve() accepts it without error, and the authorized-job check that preceded it is no longer meaningful. The design flaw is that path construction and authorization are decoupled: one parameter is authorized, a different parameter is used to locate the file.

RemediationAI

The primary remediation is to upgrade Contao CMS to a version beyond 5.7.6 as directed by the vendor security advisory at https://github.com/contao/contao/security/advisories/GHSA-grm4-wm43-9jh5. The exact patched release version is not independently confirmed from available intelligence - consult that advisory for the precise fix version. As a compensating control where immediate upgrade is not feasible, restrict backend user role assignments so that only fully trusted personnel can access any job records, since exploitation is gated by backend authentication; reducing the number of backend users with job access minimizes the exploitable population. Additionally, review whether job attachment contents include sensitive data (e.g., CSV exports, debug logs) and consider limiting what is stored in var/job-attachments until the patch is applied. Note that access controls at the backend user level do not eliminate the underlying path-construction flaw - they only reduce the attacker pool.