Security advisories

Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.

Insert tag injection via canonical URLs

2024-09-17 08:01 by Leo Feyer

Date: 2024-09-17
CVE ID: CVE-2024-45612

It is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered.

Directory traversal in the FileSelector widget

2024-09-17 08:00 by Leo Feyer

Date: 2024-09-17
CVE ID: CVE-2024-45604

Back end users can list files outside their file mounts or the document root in the FileSelector widget.

Remote command execution through file uploads

2024-09-16 08:02 by Leo Feyer

Date: 2024-09-17
CVE ID: CVE-2024-45398

Back end users with access to the file manager can upload malicious files and execute them on the server.

Session cookie disclosure in the crawler

2024-04-09 07:16 by Leo Feyer

Date: 2024-04-09
CVE ID: CVE-2024-28235

If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs.

Cross site scripting in the file manager

2024-04-09 07:15 by Leo Feyer

Date: 2024-04-09
CVE ID: CVE-2024-28190

Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the back end.

Insert tag injection via the form generator

2024-04-09 07:14 by Leo Feyer

Date: 2024-04-09
CVE ID: CVE-2024-28191

It is possible to inject insert tags via the form generator if the submitted form data is output on the page in a specific way.

Remember-me tokens are not cleared after a password change

2024-04-09 07:13 by Leo Feyer

Date: 2024-04-09
CVE ID: CVE-2024-30262

When a front end member changes their password, the corresponding remember-me tokens are not removed.

Insufficient BBCode sanitization

2024-04-09 07:12 by Leo Feyer

Date: 2024-04-09
CVE ID: CVE-2024-28234

If BBCode is enabled for comments, users can inject CSS styles.

Cross site scripting in widgets with units

2023-07-25 09:00 by Leo Feyer

Date: 2023-07-25
CVE ID: CVE-2023-36806

Authenticated users can inject malicious code in widgets with units.

Directory traversal in the file manager

2023-04-25 11:03 by Leo Feyer

Date: 2023-04-25
CVE ID: CVE-2023-29200

Authenticated users in the back end can list files outside the document root in the file manager.