Security advisories

Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.

Session cookie disclosure in the crawler

2024-04-09 07:16 by Leo Feyer

Date: 2024-04-09
CVE ID: CVE-2024-28235

If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs.

Cross site scripting in the file manager

2024-04-09 07:15 by Leo Feyer

Date: 2024-04-09
CVE ID: CVE-2024-28190

Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the back end.

Insert tag injection via the form generator

2024-04-09 07:14 by Leo Feyer

Date: 2024-04-09
CVE ID: CVE-2024-28191

It is possible to inject insert tags via the form generator if the submitted form data is output on the page in a specific way.

Remember-me tokens are not cleared after a password change

2024-04-09 07:13 by Leo Feyer

Date: 2024-04-09
CVE ID: CVE-2024-30262

When a front end member changes their password, the corresponding remember-me tokens are not removed.

Insufficient BBCode sanitization

2024-04-09 07:12 by Leo Feyer

Date: 2024-04-09
CVE ID: CVE-2024-28234

If BBCode is enabled for comments, users can inject CSS styles.

Cross site scripting in widgets with units

2023-07-25 09:00 by Leo Feyer

Date: 2023-07-25
CVE ID: CVE-2023-36806

Authenticated users can inject malicious code in widgets with units.

Directory traversal in the file manager

2023-04-25 11:03 by Leo Feyer

Date: 2023-04-25
CVE ID: CVE-2023-29200

Authenticated users in the back end can list files outside the document root in the file manager.

Cross site scripting via canonical URL

2022-05-05 08:25 by Leo Feyer

Date: 2022-05-05
CVE ID: CVE-2022-24899

Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end).

Privilege escalation with the form generator

2021-08-11 11:13 by Leo Feyer

Date: 2021-08-11
CVE ID: CVE-2021-37627

It is possible for untrusted users to gain administrator rights with the form generator.

PHP file inclusion via insert tags

2021-08-11 11:03 by Leo Feyer

Date: 2021-08-11
CVE ID: CVE-2021-37626

It is possible for untrusted users to load arbitrary PHP files via insert tags.