Read the official Contao announcements.
Contao 3.5.36 is available
by Leo Feyer
Contao version 3.5.36 is available. The bugfix release fixes a code execution vulnerability when generating PDFs (CVE-2018-17057).
Through a manipulated image file, a logged in back end user can implant arbitrary code which is executed when an article is exported as PDF in the front end. The vulnerability is in the external TCPDF library and has been fixed in TCPDF 6.2.22.