Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
Directory traversal in the FileSelector widget
by Leo Feyer
Date: 2024-09-17
CVE ID: CVE-2024-45604
Description
Back end users can list files outside their file mounts or the document root in the FileSelector widget. However, it is not possible to edit these files or view their content.
Affected versions
Contao 4.0
Contao 4.1
Contao 4.2
Contao 4.3
Contao 4.4
Contao 4.5
Contao 4.6
Contao 4.7
Contao 4.8
Contao 4.9
Contao 4.10
Contao 4.11
Contao 4.12
Contao 4.13 up to 4.13.48
Suggested solution
Upgrade to Contao 4.13.49.
More information
https://github.com/contao/contao/security/advisories/GHSA-4p75-5p53-65m9
Credits
Thanks to Jakob Steeg from usd AG for reporting this vulnerability.
