SB2026061547 - Multiple vulnerabilities in Contao

Description

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in the crawler HTTP client options handling when crawling external links or configured additional URIs. A remote user can cause the crawler to request an attacker-controlled external URL to disclose sensitive information.

User interaction is required to have the crawler process an external URL, for example through a link on a crawled page while the broken-link checker is enabled.

2) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to path traversal in JobsController::downloadJobAttachment() and attachment lookup logic when handling a crafted attachment identifier in the job attachment download endpoint. A remote user can supply an attachment identifier containing traversal sequences to disclose sensitive information.

This is a cross-job authorization bypass limited to files within the var/job-attachments storage, and exploitation requires knowledge of the target job UUID and attachment filename.

Remediation

Install update from vendor's website.

References

• https://github.com/contao/contao/security/advisories/GHSA-3mr9-p497-58f6
• https://github.com/contao/core-bundle/blob/e550b92a01ef625bd546e6c3956dd200af05ebf0/src/Crawl/Escargot/Factory.php
• https://github.com/contao/contao/security/advisories/GHSA-grm4-wm43-9jh5