Packagist · contao/contao
Contao: Possible path traversal in job download URIs
An authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments.
The controller authorizes only the jobUuid route parameter. The later attachment lookup joins that authorized job UUID with the attacker-controlled identifier, then passes the combined path to the virtual filesystem. VirtualFilesystem::resolve() canonicalizes the whole path and only rejects paths that escape the filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes victim-job/debug_log.csv.
This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values.
JobsController::downloadJobAttachment() checks access to the route jobUuid before loading the attachment:
$job = $this->jobs->getByUuid($jobUuid);
if (!$job || !$this->jobs->hasAccess($job)) {
throw $this->createNotFoundException();
}
$attachment = $this->jobs->getAttachment($jobUuid, $identifier);
Jobs::getAttachment() then resolves a path built from the authorized job UUID and the attacker-controlled identifier:
$fileItem = $this->jobAttachmentsStorage->get($this->getAttachmentIdentifier($job, $identifier));
return $job->getUuid().'/'.$identifier;
VirtualFilesystem::resolve() canonicalizes the combined path. It rejects absolute paths and paths that start with .., but it does not preserve the authorized job directory as a boundary:
$path = Path::canonicalize($location);
if (str_starts_with($path, '..')) {
throw new \OutOfBoundsException(...);
}
return Path::join($this->prefix, $path);
Therefore:
<authorized-job>/../<victim-job>/debug_log.csv
canonicalizes to:
<victim-job>/debug_log.csv
which remains inside the job-attachments filesystem mount and is accepted.
Treat the attachment identifier as a filename, not a path:
/, \, NUL, and dot-segment components in identifier.{identifier} if nested attachment paths are not intended.<authorized-job-uuid>/ before returning a FilesystemItem.Jobs::addAttachment() so future producers/extensions cannot write outside the owning job directory.A low-privileged backend user can read another job's attachment if they know or obtain the target job UUID and attachment filename. Built-in crawler jobs attach CSV logs such as debug_log.csv, broken-link-checker_log.csv, and search-index_log.csv, which can contain crawled URLs, referring URLs, tags, and error messages.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.