CVE-2026-107844: 
PHP Análisis y mitigación de vulnerabilidades

CVE-2026-107844 is a path traversal vulnerability in the Contao open-source CMS affecting the ImagesController component. It allows unauthenticated remote attackers to read files outside the intended image target directory by supplying percent-encoded parent-directory segments in the {path} route parameter. Affected versions are >= 5.0.0 (and >= 4.1.0 per the GitHub Advisory Database) through < 5.3.50, and >= 5.4.0-RC1 through < 5.7.12. The vulnerability was published by maintainer leofeyer on August 25, 2026, and added to the GitHub Advisory Database on October 9, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Contao Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). ImagesController::__invoke() constructs the target file path by calling Path::join($this->targetDir, $path), which canonicalizes .. segments, but never invokes Path::isBasePath() to verify the resulting path remains within the configured image target directory. An unauthenticated attacker can send a crafted HTTP GET request with percent-encoded dot segments (e.g., %2e%2e/) in the {path} route parameter to traverse outside the target directory; the resolved file is then served via BinaryFileResponse. File reads are constrained to extensions listed in contao.image.valid_extensions (jpg, jpeg, gif, png, tif, tiff, bmp, svg, svgz, webp), and paths beneath the upload directory fail due to an unrelated server-side error. Both Apache (with the shipped public/.htaccess) and nginx (with the documented configuration) are affected. The fix, introduced in commit 867c055, adds a Path::isBasePath() check immediately after path joining and throws a NotFoundHttpException if the path escapes the target directory (Contao Advisory, Fix Commit).

Successful exploitation allows any unauthenticated visitor to read files stored outside the document root but within the project directory, provided those files carry an image-type extension permitted by contao.image.valid_extensions. This could expose sensitive configuration files, private keys, or other assets that happen to use an allowed extension. Additionally, the route functions as an existence oracle — an attacker can determine whether arbitrary filesystem paths exist — and on debug-enabled instances, 404 error messages may disclose absolute filesystem paths, aiding further reconnaissance. Integrity and availability are not impacted; the practical scope is limited to confidentiality of image-typed files outside the files/ upload directory (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.0, reflecting a very low current probability of exploitation (EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability was discovered and reported by HDWSec (Contao Advisory).

1. Reconnaissance: Identify internet-facing Contao CMS instances running versions >= 5.0.0 and < 5.3.50, or >= 5.4.0-RC1 and < 5.7.12, using tools such as Shodan, Censys, or by inspecting HTTP response headers and page metadata.
2. Identify the ImagesController route: Locate the image serving endpoint, typically accessible at a path such as /assets/images/{path} or the configured image route in the Contao installation.
3. Craft a path traversal payload: Construct a GET request where the {path} parameter contains percent-encoded parent-directory traversal sequences (e.g., %2e%2e%2f or %2e%2e/) to escape the image target directory. For example: GET /assets/images/%2e%2e%2f%2e%2e%2fconfig/parameters.yml.jpg
4. Probe for file existence: Send requests with varying traversal depths and target filenames to use the route as an existence oracle — a 200 response (or a debug 404 with a path disclosure) confirms the file exists.
5. Retrieve target files: Issue GET requests for files with extensions matching contao.image.valid_extensions (jpg, jpeg, gif, png, tif, tiff, bmp, svg, svgz, webp) that reside outside the document root but within the project directory. The server returns the file content via BinaryFileResponse.
6. Leverage path disclosures: On debug-enabled instances, analyze 404 error messages to extract absolute filesystem paths, which can inform further traversal attempts (Contao Advisory, Fix Commit).

• Network: Unusual HTTP GET requests to the Contao image serving endpoint containing percent-encoded dot segments (e.g., %2e%2e, %2e%2e%2f, ..%2f) in the path parameter; requests for image-extension files (.jpg, .png, .svg, etc.) that resolve to paths outside the expected image target directory.
• Logs: Web server access logs showing GET requests with encoded traversal sequences in the image route path (e.g., /assets/images/%2e%2e%2f...); repeated 200 or 404 responses to such requests from the same source IP, indicating path enumeration activity; debug-mode 404 responses containing absolute filesystem paths in the response body.
• Application Logs: Contao application logs showing NotFoundHttpException messages referencing unexpected file paths (on patched systems) or successful BinaryFileResponse deliveries for files outside the image target directory (on unpatched systems).

Upgrade Contao to version 5.3.50 or 5.7.12 (or later), which introduce a Path::isBasePath() boundary check in ImagesController before serving any file (Contao Release 5.3.50, Contao Release 5.7.12). If immediate patching is not possible, consider deploying Web Application Firewall (WAF) rules to block requests containing encoded parent-directory sequences (%2e%2e, %252e, etc.) targeting the image controller route. Additionally, disabling debug mode on production instances will prevent absolute filesystem path disclosure via error messages (GitHub Advisory).

The vulnerability was credited to researcher HDWSec, who reported it to the Contao project. The advisory was published by Contao maintainer leofeyer on August 25, 2026, with the fix merged promptly in the same release cycle. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (Contao Advisory).