CVE-2026-55825: 
PHP vulnerability analysis and mitigation

CVE-2026-55825 is a path traversal vulnerability (CWE-22) in Contao, an open-source CMS, affecting versions 5.7.0 through 5.7.6 of the contao/core-bundle package. An authenticated backend user with access to at least one job can exploit crafted ../ segments in attachment identifiers to read files from other job directories within var/job-attachments, constituting a cross-job authorization bypass. The vulnerability was published on July 31, 2026, and patched in version 5.7.7. It carries a CVSS v3.1 base score of 3.1 (Low) (GitHub Advisory, ENISA EUVD).

The root cause lies in JobsController::downloadJobAttachment(), which authorizes access based solely on the jobUuid route parameter but then passes an attacker-controlled identifier parameter to Jobs::getAttachment(). This method constructs a path by joining the authorized job UUID with the user-supplied identifier (e.g., authorized-job/../victim-job/debug_log.csv). The VirtualFilesystem::resolve() method canonicalizes the combined path and only rejects paths that escape the filesystem mount entirely (i.e., those starting with ..), so a traversal like /../victim-job/debug_log.csv canonicalizes to victim-job/debug_log.csv, which remains within the mount and is accepted. The identifier is treated as a path rather than a sanitized filename, and no validation rejects /, \, NUL, or dot-segment components (GitHub Advisory).

A low-privileged authenticated backend user can read attachment files belonging to other jobs they are not authorized to access, provided they know or can obtain the target job's UUID and attachment filename. Built-in crawler jobs attach CSV logs such as debug_log.csv, broken-link-checker_log.csv, and search-index_log.csv, which may contain crawled URLs, referring URLs, tags, and error messages. There is no integrity or availability impact; the vulnerability is limited to a low-level confidentiality breach within the var/job-attachments directory (GitHub Advisory).

1. Authentication: Log in to the Contao backend as a user with at least read access to one job (the "authorized job").
2. Obtain target information: Identify or obtain the UUID of a victim job and the filename of an attachment within that job (e.g., debug_log.csv). Job UUIDs are UUID v4 values, so this step requires prior knowledge or information disclosure from another source.
3. Craft malicious identifier: Construct an attachment identifier containing path traversal segments, such as ../victim-job-uuid/debug_log.csv, where victim-job-uuid is the target job's UUID.
4. Send crafted request: Submit a request to the job attachment download endpoint using the authorized job's UUID as the jobUuid route parameter and the crafted traversal string as the identifier parameter.
5. Receive victim file: The server canonicalizes the combined path, resolves it to the victim job's attachment file, and returns its contents — bypassing the authorization check that only validated the authorized job UUID (GitHub Advisory).

• Logs: Web server or application access logs showing requests to the job attachment download endpoint with identifier parameters containing ../ or URL-encoded equivalents (e.g., %2F..%2F, %2e%2e%2f) alongside a valid jobUuid.
• Logs: Repeated access log entries for the same endpoint with varying identifier values referencing known attachment filenames such as debug_log.csv, broken-link-checker_log.csv, or search-index_log.csv from different job UUIDs.
• Network: Unusual download activity from authenticated backend users accessing job attachment endpoints for jobs they do not own or manage.

Upgrade contao/core-bundle to version 5.7.7, which is the patched release addressing this vulnerability. The recommended fix involves treating the attachment identifier strictly as a filename by rejecting /, \, NUL, and dot-segment components; adding a route requirement to prevent slashes in the {identifier} parameter; and asserting the canonical relative path starts with the authorized job directory before returning a file item. No configuration-based workaround is documented; upgrading to 5.7.7 is the only supported remediation (GitHub Advisory).