[MEDIUM] Contao: Path traversal in the images controller

PKSA-6j5h-bxmj-94h9 CVE-2026-107844 GHSA-mrvp-7wmx-5m4h

Affected package: contao/core-bundle

Affected version: >=5.4.0-RC1,<5.7.12|>=4.1.0,<5.3.50

Reported by:
GitHub