Detections
Analytics
SCA: security update for contao/contao, contao/core-bundle (GHSA-grm4-wm43-9jh5)
low Tenable Cloud Security Plugin ID 445779
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can
access one job can request an attachment identifier containing ../ segments and make the job attachment
download endpoint read a file from another job directory inside var/job-attachments. The controller
authorizes only the jobUuid route parameter. The later attachment lookup joins that authorized job UUID
with the attacker-controlled identifier, then passes the combined path to the virtual filesystem.
VirtualFilesystem::resolve() canonicalizes the whole path and only rejects paths that escape the
filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes victim-job/debug_log.csv. This is
a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against
unknown jobs because job directories are UUID v4 values. (CVE-2026-55825)
Solution
Update the contao/contao library and its related packages to version 5.7.7 or later.See Also
Plugin Details
Severity: Low
ID: 445779
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 8/7/2026
Updated: 8/7/2026
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.1
Temporal Score: 1.6
Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2026-55825
CVSS v3
Risk Factor: Low
Base Score: 3.1
Temporal Score: 2.7
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/6/2026
Vulnerability Publication Date: 7/31/2026
Reference Information
CVE: CVE-2026-55825
cwe: CWE-22