Contao Edit-Multiple Flaw Let Restricted Users Modify Folders Outside Their Filemount

·10 views

A vulnerability tracked as CVE-2026-126662 in the Contao content management system allows backend users restricted to one filemount to change folders outside that boundary via the Edit-Multiple bulk action. The flaw is an access-control bypass and requires an existing backend account with file-manager permissions. Contao lists affected versions as 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6, with fixes available in the corresponding patched releases. The advisory does not establish that outside files are executable, that anonymous visitors can exploit it, or that exploitation has occurred. Administrators are advised to update, verify restricted-user behavior, review file-change logs, and compare affected folders against trusted backups if the boundary may have been crossed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why a Prompt That Looks Good Still Needs Systematic Evaluation

A prompt's output can seem confident and correct while still containing errors, so a convincing result is not evidence that it works. The author argues teams should verify AI output against a defined 'Definition of Done' before trusting it, since a 100% acceptance rate may signal that nobody is checking. Prompts should be tested like code, using several real inputs rather than a single example, and re-tested whenever they run in production. Quantitative checks that a computer can run, such as word count or passing tests, should be automated first because they are cheap and fast. Tools like promptfoo can provide a lightweight evaluation framework to run these checks whenever a prompt changes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building an AI Center of Excellence: Structure, Roles, and Common Pitfalls

The article argues that organizations setting up an AI Center of Excellence often focus first on staffing and reporting lines, when the more important question is which AI practices must be uniform, which should be shared defaults, and which teams should decide for themselves. Getting this governance split wrong can leave a CoE either bottlenecked by reviews or existing only as an unenforced policy. The author cites a global industrial automation company whose regional CoE spent nine or ten months stalled on one workflow, held back by cloud AI skills gaps and by rebuilding infrastructure already available as a company platform service. The piece describes the core purpose of a CoE as preventing fragmented AI efforts, improving investment decisions, building organization-wide AI skills, and reducing duplicated spending. It also links these failures to the trust and identity issues that can stall an AI CoE even when its structure looks correct on paper.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Qué es una API y por qué conecta casi todo el software que usas

An article explains APIs (Application Programming Interfaces) using a restaurant analogy, where the API acts as the waiter between an app and the system that supplies its data. It notes that weather, maps, and payment features in everyday apps often come from other services through this invisible intermediary. The piece describes how requests use a fixed format with a method, resource address, and parameters, and how responses arrive in structured data such as JSON. It also covers access controls like secret API keys, usage limits, and permissions, and cites open banking, government open data, and AI services as examples of APIs in practice. The article was written by José Ángel Maldonado Guzmán, an engineering student at the Universidad Autónoma del Estado de México.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Adding a Booking Flow to a Next.js App with a REST API

Building a booking page in Next.js is simple on the frontend, but the backend scheduling logic, which must handle staff availability, service durations, existing bookings, buffers, and race conditions, is where projects grow complex. The guide proposes offloading that logic to a booking API so developers can focus on the frontend. A working booking flow has four parts: a service catalog, real-time availability, a cart and checkout, and post-booking management such as rescheduling and cancellation. The example uses the Opencals API with the @opencals/storefront-sdk package on Next.js 14+ and Node 18+. The API key must stay server-side, since it can create real bookings and payments, so all calls go through Route Handlers or Server Actions.

0 comments Read more at DEV Community