Contao's Public Title Count Cannot Show Who Owns a Filemount
Contao sites can present as a company website, a member portal or a custom application. The content management system is often visible only in the administration path. A count-only search shows a broad title footprint and almost no exact app match.
ZoomEye queries used sub_type=all, page 1 and page size 1 on 2026-11-13 between 08:49 and 08:50 Asia/Shanghai.
| Query | Matching assets |
|---|---|
app="Contao" |
1 |
title="Contao" |
3,351 |
The title count may include sites with Contao branding, documentation, agencies and unrelated pages. The single app match is not enough to describe the public Contao population. Neither count can show backend users, filemounts or filesystem permissions.
The issue is delegated access
CVE-2026-126662 allows filemount-restricted backend users to modify folders outside their filemount through the Edit-Multiple operation. It affects Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6.
The attacker needs a backend account and the file-manager capability. The vulnerability changes the boundary between intended content folders and other writable paths. It does not prove that every affected account can modify executable code.
Build an owner inventory
Use the title candidates to identify sites that may belong to the organization. Then confirm the CMS from the asset record, login path or deployment metadata. Do not attempt a backend operation on an unknown site.
For each confirmed Contao installation, record the version, backend users, filemounts and the web server's write permissions. Include agency-managed sites and multisite deployments.
Review the operation
Review recent Edit-Multiple actions, file renames, uploads and changes outside expected folders. Compare the selected paths with the user's assigned filemount. Preserve application logs and file hashes where available.
Patch and verify
Apply the fixed version for the active branch. Test with a restricted account: use Edit-Multiple on an allowed folder, then attempt a folder outside the filemount and confirm that it is rejected.
Reduce file-manager rights and remove unnecessary write access to templates, extensions and configuration. A backup comparison and an application log are stronger evidence than a product title.
Measurement conclusion
The 3,351 title matches are useful for finding Contao sites, but the CVE is about authorization inside a logged-in backend. The app count of 1 says little about the installed base because fingerprints and exposed paths vary.
For this vulnerability, ZoomEye starts an ownership review. The filemount and audit trail decide whether the bug matters at a given site.
Top comments (0)