Security advisories

Here you will find a list of vulnerabilities that have already been found and fixed in Contao.

2019

Date: 2019-04-30
CVE ID: CVE-2019-11512

The search menu of the file manager is vulnerable to SQL injections. The problem affects all Contao versions as of Contao 4.1 and has been fixed in Contao 4.4.39 and 4.7.5.

Date: 2019-04-09
CVE ID: CVE-2019-10643

Confirming an opt-in token does not invalidate previous opt-in tokens. The problem affects Contao 4.7 and has been fixed in Contao 4.7.3.

Date: 2019-04-09
CVE ID: CVE-2019-10642

The request token check can be bypassed. The problem affects Contao 4.7 and has been fixed in Contao 4.7.3.

Date: 2019-04-09
CVE ID: CVE-2019-10641

User sessions are not invalidated if a user changes their password. The problem affects all Contao versions and has been fixed in Contao 3.5.39, 4.4.37 and 4.7.3.

Security policy

If you think that you have found a se­cu­ri­ty is­sue in Con­tao, please re­port it ac­cor­ding to our se­cu­ri­ty poli­cy.