Contao CMS: Privilege Escalation to Code Execution through the Theme Import

Presentation

Contao carries a quirk inherited from its early days: its legacy templates use the .html5 extension and are interpreted as PHP. The back office theme import unpacks a user-supplied ZIP archive and writes its contents to the templates directory.

HDW Sec found that a non-administrator back office user can use this to write arbitrary PHP to disk and have it executed by the web server. Contao rated it 8.8 high; HDW Sec had scored it 7.2.

Issue(s)

• extractThemeFiles() writes every archive entry whose name starts with templates/ straight to disk, with no allow-list of extensions (core-bundle/contao/classes/Theme.php).
• An archive containing templates/x.html5 filled with PHP is therefore written verbatim, then executed under the web server user as soon as the template is rendered.
• The permission model lets a non-admin user reach the import, so the flaw is also a privilege escalation: the account ends up with capabilities equivalent to an administrator.
• This is a surviving sibling of the template editor restriction added in 5.7.3, which closed a different path to the same sink.
• Chained with the comments bundle XSS (GHSA-628f-v4f6-p37r), the import can be driven from the victim’s own browser, turning an anonymous comment into code execution on the server.

References

• GitHub advisory: GHSA-r9qp-pqx5-8369
• Fixed in Contao 5.3.50 and 5.7.12, published 2026-08-25. No CVE assigned as of publication.