Contao's Edit-Multiple Action Allowed a Filemount User to Leave the Assigned Folder

Contao uses filemounts to limit where a backend user can work in the file manager. CVE-2026-126662 affects the Edit-Multiple operation. A user restricted to one folder can modify folders outside that filemount through the bulk edit action.

The vulnerability is an access-control bypass, not a failed login. The attacker needs a backend account and the file-manager capability. Contao lists affected versions as 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6.

The vendor advisory and the CVE description establish the boundary failure. They do not claim that every file outside the filemount is executable or that every affected account can reach the application root.

Delegated authority is still authority

Content teams often use backend roles that can upload assets, edit pages and organize files. A filemount is a practical way to keep one department from modifying another department's content. When a bulk operation accepts a different folder list, the UI's apparent restriction is no longer enough.

The risk grows when the web process can write to directories that contain templates, extensions, cache or uploaded code. The exact impact depends on filesystem permissions and which files the backend account can select. A file write may become content tampering before it becomes code execution.

Contao's public advisory says filemount-restricted backend users can modify folders outside the filemount. It does not establish that an anonymous visitor can trigger the operation or that exploitation has occurred.

Inventory the role model

List backend users with file-manager access, their filemounts and the folders they should be able to modify. Compare those intended boundaries with the effective filesystem ACLs and the Contao configuration.

Review recent bulk edits, folder renames, file uploads and changes outside the expected content paths. Preserve Contao logs and the web server's file audit trail if available. A missing application event is not proof that no file changed.

Upgrade and recheck

Apply the fixed release for the installed branch: 5.3.54, 5.7.17 or 6.0.6. After the update, test with a restricted test user and the Edit-Multiple action. Confirm that the request rejects a folder outside the filemount and that a permitted operation still succeeds.

Reduce the number of accounts with file-manager permissions and review which backend roles can select multiple assets. Remove write access for the web process to code paths that do not need runtime updates.

Content integrity

If the boundary may have been crossed, compare the affected folders with a known-good backup or deployment artifact. Check for new files, changed templates and unexpected configuration. Rotate credentials for backend users who could perform the operation.

The important distinction is between a suspicious file and a confirmed authorization bypass. The advisory supplies the vulnerability fact; file hashes, logs and backup comparison determine whether a site needs containment or recovery.

References

• Contao Security Advisory GHSA-9jfh-v443-w3fj
• VulnCheck advisory for CVE-2026-126662