This vulnerability allows an authenticated backend user to request a job‑attachment download with a crafted identifier that contains path segments such as "../". The Contao controller authorizes the job UUID but accepts the provided identifier verbatim, resulting in the virtual filesystem resolving a path that leaves the job’s own directory and points to another job’s attachment. This is a classic directory traversal flaw (CWE-22) that leads to confidential information disclosure by reading attachments from other jobs, but it does not allow arbitrary command execution or full system compromise.

The flaw exists in Contao CMS versions 5.7.0 through 5.7.6. Any installation of contao: contao within those revision ranges without the fix is affected. Versions outside this range, or later releases, are not impacted.

The CVSS score of 3.1 indicates moderate severity, and the EPSS score of less than 1% shows a very low but non-zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user with backend authentication who can access a job; brute‑forcing unrelated job UUIDs is difficult because job directories are UUID‑v4 values. Thus the attack surface is limited to users who already have legitimate backend access, but within that group the attacker can read files from other jobs’ attachment directories.