Contao CMS EUVD-2026-95974

Exploitation requires reaching the Contao ImagesController route (the image-serving endpoint) on an affected version (5.0.0 through pre-5.3.50 / pre-5.7.12) and supplying a {path} value with parent-directory segments; no authentication, privileges, or user interaction are needed (PR:N/UI:N). Key LIMITING factors sharply narrow real-world impact: the returned file MUST carry an extension listed in the contao.image.valid_extensions configuration, and per the advisory files below the upload directory were NOT demonstrated to be readable, so this is extension-restricted disclosure of project-directory files plus path-existence probing - not arbitrary file read. Absolute filesystem path disclosure additionally depends on debug responses being enabled.

This is a limited-impact information disclosure vulnerability (CWE-22 path traversal) that the signals consistently rate as moderate rather than critical. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) agrees with the description: network-reachable, low-complexity, unauthenticated (PR:N), with only low confidentiality impact and no integrity or availability impact. The impact ceiling is genuinely constrained - the flaw only exposes files whose extension is in contao.image.valid_extensions and, per the advisory, files below the upload directory were NOT shown to be readable, so this is not a general arbitrary-file-read. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input; therefore this is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. Net assessment: a real but low-to-moderate priority issue - easy to trigger and unauthenticated, but with limited data exfiltration value (extension-restricted reads plus path-existence/absolute-path disclosure via debug responses). Patch on a normal cadence rather than treating as an emergency.

An unauthenticated attacker sends an HTTP request to the Contao images route with a {path} parameter containing encoded parent-directory segments (e.g. ../) so the joined path escapes the configured image target directory. Because the pre-patch code used Path::join() without Path::isBasePath() validation, the canonical path outside the target is served via BinaryFileResponse, letting the attacker read project files that carry an allowed image extension or probe whether arbitrary paths exist. No public POC was provided, but the low attack complexity (AC:L) and lack of required privileges or user interaction make exploitation straightforward.