Insert tag injection via the form generator

Date: 2024-04-09
CVE ID: CVE-2024-28191

It is possible to inject insert tags via the form generator if the submitted form data is output on the page in a specific way.

Affected versions

Contao 4.0
Contao 4.1
Contao 4.2
Contao 4.3
Contao 4.4
Contao 4.5
Contao 4.6
Contao 4.7
Contao 4.8
Contao 4.9
Contao 4.10
Contao 4.11
Contao 4.12
Contao 4.13 up to 4.13.39
Contao 5.0
Contao 5.1
Contao 5.2
Contao 5.3 up to 5.3.3

Suggested solution

Upgrade to Contao 4.13.40 or 5.3.4.

Workaround

Do not output the submitted form data on the website.

More information

https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8