CVE-2026-107844

Executive Summary

CVE-2026-107844 is a path traversal vulnerability (CWE-22) in Contao, an open-source CMS, affecting versions from 5.0.0 up to and including 5.3.49 and 5.7.0 through 5.7.11. The ImagesController joins the user-controlled {path} parameter to the configured image target directory using Path::join() without verifying the canonical result stays within that base directory via Path::isBasePath(). An unauthenticated attacker can supply encoded parent-directory segments to return files under the project directory and to probe for the existence of arbitrary filesystem paths, with a limited confidentiality impact (CVSS 5.3).

Technical Analysis

The flaw resides in the CMS ImagesController component. According to the NVD description, the controller builds a file path by joining a user-controlled {path} parameter to the configured image target directory using Path::join(). Crucially, the code does not call Path::isBasePath() on the canonicalized result, which is the standard safeguard against traversal: isBasePath() (or an equivalent canonical-prefix check) would confirm that the resolved path remains a child of the configured base directory before the file is served.

Because that check is absent, encoded parent-directory segments embedded in {path} cause Path::join() to resolve outside the intended image target directory while remaining under the project directory. The resolved file is then streamed back to the caller via BinaryFileResponse, but only when its filename uses an extension permitted by the contao.image.valid_extensions configuration. This extension constraint acts as a partial filter, limiting which otherwise-traversable files can actually be disclosed.

Two secondary disclosure channels are described: the route can reveal whether arbitrary paths exist (existence oracle), and debug responses (i.e., when debug mode is enabled) can disclose absolute filesystem paths. Notably, the description states that paths below the upload directory were not shown to be readable — meaning the traversal is bounded in observed behavior to the project directory and does not demonstrably reach the upload directory. The vulnerability is an unauthenticated, low-complexity, network-reachable information-disclosure issue.

The affected range is bracketed by fixed releases 5.3.50 and 5.7.12. No function names, parameters, or code paths beyond those in the NVD text (ImagesController, {path}, Path::join(), Path::isBasePath(), BinaryFileResponse, contao.image.valid_extensions) should be assumed. Patch confidence is CLAIMED (2/4): a single source (GHSA) indicates the fix, and this has not been independently confirmed.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE as of the data provided; the chain below is inferred from the vulnerability class (unauthenticated path traversal via a URL path parameter).

1. Reconnaissance / target identification. An attacker identifies a publicly reachable Contao instance running an affected version within the 5.0.0–5.3.49 or 5.7.0–5.7.11 range. The ImagesController route is unauthenticated, so no credentials or prior access are required.

2. Triggering the flaw. The attacker sends a crafted request to the image-serving route, embedding URL-encoded parent-directory segments in the {path} parameter (for example, encoded .. sequences). Because ImagesController joins {path} to the configured image target directory with Path::join() and never calls Path::isBasePath() on the canonical result, the request escapes the intended directory while remaining under the project directory.

3. Payload / execution method (class level). The traversal is a pure path-manipulation attack — no code execution is involved. The response is produced by BinaryFileResponse only if the target file's extension is permitted by contao.image.valid_extensions. Attackers will therefore attempt to read project-directory files whose extensions match that allowlist. Responses also serve as an existence oracle for arbitrary paths, and when debug mode is active, error/debug output may leak absolute filesystem paths that aid further traversal attempts.

4. Post-exploitation impact. Confidentiality is limited to files under the project directory matching the allowed extensions, plus path-existence and (in debug mode) absolute-path metadata. No integrity or availability impact is described, and no administrative or authenticated access is demonstrated. The description explicitly notes that files below the upload directory were not shown to be readable, bounding the practical exposure.

Impact Assessment

The CVSS v3.1 base score is 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Subscores indicate: network-exploitable (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), limited confidentiality impact (C:L), and no integrity (I:N) or availability (A:N) impact.

Business impact centers on information disclosure. Depending on repository layout and the contao.image.valid_extensions allowlist, an attacker may be able to retrieve configuration files, templates, or other project-directory artifacts bearing permitted extensions, and to enumerate which paths exist. Absolute filesystem paths leaked in debug responses can materially improve the precision of follow-on attacks. Because exploitation is unauthenticated and involves a single crafted request, the population of affected systems is broad: any internet-exposed Contao deployment on the vulnerable version ranges is a candidate. Blast radius is bounded by two factors — the extension allowlist and the described limitation that paths below the upload directory were not demonstrably readable. EPSS is not yet scored by FIRST.org; no exploit-in-the-wild or CISA KEV evidence is associated with this CVE.

Detection Guidance

Sigma Rule

title: Contao ImagesController Path Traversal Attempt (CVE-2026-107844)
id: 5f2a1c9e-3d7b-4a6e-9c1f-contao107844
status: experimental
description: Detects encoded parent-directory segments in Contao image route requests, indicating attempted path traversal (CVE-2026-107844).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107844
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_route:
    cs-uri-stem|contains:
      - '/images'
  selection_traversal:
    cs-uri-query|contains:
      - '..%2f'
      - '..%2F'
      - '%2e%2e%2f'
      - '%2e%2e%2F'
      - '%252e%252e%252f'
      - '..%5c'
      - '....//'
  condition: selection_route and selection_traversal
falsepositives:
  - Legitimate image requests containing unusual but benign encodings
level: high
tags:
  - attack.t1190
  - cwe.22
  - cve.2026-107844

YARA Rule

rule CVE_2026_107844_Contao_Traversal
{
    meta:
        description = "Detects Contao ImagesController traversal attempts in HTTP request logs or captured traffic (CVE-2026-107844)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107844"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $route = "/images" ascii nocase wide
        $trav1 = "..%2f" ascii nocase wide
        $trav2 = "..%2F" ascii nocase wide
        $trav3 = "%2e%2e%2f" ascii nocase wide
        $trav4 = "..%5c" ascii nocase wide
        $trav5 = "....//" ascii nocase wide

    condition:
        $route and any of ($trav*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107844 Contao ImagesController Path Traversal Attempt"; flow:established,to_server; http.uri; content:"/images"; http.uri; pcre:"/(?:\.\.|%2e%2e)(?:%2f|%5c|\/|\\)/i"; classtype:web-application-attack; reference:cve,2026-107844; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107844; sid:2026107844; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where network.protocol == "http"
    and url.path : "/images"
    and url.query : ("*..%2f*" or "*..%2F*" or "*%2e%2e%2f*" or "*..%5c*" or "*....//*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval decoded=urldecode(uri_query)
| where (uri_path LIKE "%/images%" OR uri_path LIKE "%/images")
    AND (uri_query LIKE "%..%2f%" OR uri_query LIKE "%..%2F%"
         OR uri_query LIKE "%2e%2e%2f%" OR uri_query LIKE "%2e%2e%2F%"
         OR uri_query LIKE "%..%5c%" OR uri_query LIKE "%....//%"
         OR decoded LIKE "%../%" OR decoded LIKE "..\\%")
| stats count min(_time) as first_seen max(_time) as last_seen
    values(uri_path) as paths values(uri_query) as queries by src_ip
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,contao,cve-2026-107844">
  <rule id="1007844" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>\.\.%2f|\.\.%2F|%2e%2e%2f|%2e%2e%2F|\.\.%5c|\.\.\.\.//</url>
    <regex>/images</regex>
    <description>CVE-2026-107844: Contao ImagesController path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_scan,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch; not independently confirmed).

1. Immediate mitigations.

   • Upgrade is the primary control. If upgrade cannot be performed immediately, restrict or block unauthenticated access to the Contao image-serving route (the ImagesController path) at the reverse proxy or WAF, and deploy virtual patching that rejects requests whose {path} parameter contains encoded parent-directory sequences.
   • Disable debug mode in production so that debug responses cannot disclose absolute filesystem paths.
   • Tighten the contao.image.valid_extensions allowlist to the minimum necessary set of image extensions, reducing the set of project-directory files that a traversal attempt could expose via BinaryFileResponse.
   • Monitor and alert on traversal-pattern requests using the detections provided above.

2. Patch / upgrade steps.

   • Upgrade affected 5.3.x deployments to 5.3.50 or later.
   • Upgrade affected 5.7.x deployments to 5.7.12 or later.
   • Apply via your normal Contao dependency/composer workflow, then validate that the fixed ImagesController performs a canonical-path containment check (e.g., Path::isBasePath()) before response generation.
   • Because patch confidence is only CLAIMED from a single GHSA source, independently verify the fix by confirming the affected path is no longer reachable after upgrade.

3. Long-term hardening.

   • Adopt a defense-in-depth rule: any filesystem path derived from user input must be canonicalized and validated against its intended base directory before use.
   • Maintain a production WAF ruleset that normalizes and inspects encoded traversal sequences, including double-encoding.
   • Keep Contao current and subscribe to vendor security advisories to catch future releases within the 5.x lines.
   • Minimize verbosity of error/debug output on externally reachable services.

References

• NVD — CVE-2026-107844: https://nvd.nist.gov/vuln/detail/CVE-2026-107844
• GitHub Security Advisory (GHSA) for CVE-2026-107844 (vendor fix reference for 5.3.50 and 5.7.12)
• Contao CMS official security advisories / release notes: https://contao.org/en/security-advisories
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-107844 not listed; no known in-the-wild exploitation or threat-actor campaign identified at time of writing)