Contao Filemount Flaw Lets Restricted Backend Users Edit Folders Outside Their Scope

·5 views

A security issue tracked as CVE-2026-126662 lets Contao backend users limited by filemount restrictions modify folders outside their assigned paths through the Edit-Multiple operation. The flaw affects Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6, and exploitation requires a backend account with file-manager capability. A ZoomEye analysis found 3,351 title matches for Contao but only one exact app match, noting that these counts cannot reveal backend users, filemounts or permissions. Administrators are advised to confirm installations, review recent Edit-Multiple activity and file changes, apply the fixed versions, and test restrictions with a limited account. The analysis stresses that the vulnerability concerns authorization within logged-in backends rather than the public footprint of the CMS.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Browser-based GIF compression and resizing without uploading files to a server

Chat apps still enforce upload limits on GIFs, and sending clips to online compressors raises privacy concerns. The approach described decodes and re-encodes GIFs entirely inside a browser tab, using a Web Worker to keep the main thread responsive. Memory is managed with a total pixel cap and downscaling for oversized files, while frame delays are clamped to 20 ms to avoid clients playing them slower. Opaque animations are further shrunk by writing only changed pixel regions between frames. To hit byte targets, the tool steps through a fixed sequence of color, scale, and frame reductions until the output fits.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How an iPhone Microphone Is Turned Into a Decibel Meter

A developer at W Lab describes building Noise Meter, an iPhone app that displays sound levels in decibels and logs them overnight. The core challenge is disabling iOS's default microphone processing, such as gain control and noise suppression, which would distort readings. The app applies standard frequency weightings (A, C, and Z) using filters derived from IEC 61672-1, adapted to the device's sample rate. Measurements are averaged into per-second records that track both energy-based equivalent levels and short-term peaks. The post also explains that dBFS readings must be converted to dB SPL to match standard sound level meter output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Contao Edit-Multiple Flaw Let Restricted Users Modify Folders Outside Their Filemount

A vulnerability tracked as CVE-2026-126662 in the Contao content management system allows backend users restricted to one filemount to change folders outside that boundary via the Edit-Multiple bulk action. The flaw is an access-control bypass and requires an existing backend account with file-manager permissions. Contao lists affected versions as 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6, with fixes available in the corresponding patched releases. The advisory does not establish that outside files are executable, that anonymous visitors can exploit it, or that exploitation has occurred. Administrators are advised to update, verify restricted-user behavior, review file-change logs, and compare affected folders against trusted backups if the boundary may have been crossed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Nvidia's ASPIRE Lets Robots Write, Debug and Reuse Their Own Skills

Nvidia researchers, working with several universities, have introduced ASPIRE, a framework that lets robots generate their own control code, detect failures, repair them, and store verified fixes as reusable skills. Unlike most robot learning systems that discard solutions after each task, ASPIRE is designed so that experience accumulates over time. It relies on code-as-policy, where a language model produces Python control programs rather than raw motor commands, making the logic readable and transferable across robot bodies and environments. The system operates in a continuous learning loop supported by fine-grained execution traces that help pinpoint exactly where a multi-step task went wrong. Nvidia released an initial skill library in June 2026 and a broader open-source version, ASPIRE v1.0, in October 2026.

0 comments Read more at DEV Community