Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
by Leo Feyer
Exposure of sensitive information through a stale search index
Date
25.08.2026
CVE ID
CVE-2026-107842
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
5.3.50, 5.7.12
Security advisory
by Leo Feyer
Unrestricted activation email resending
Date
25.08.2026
CVE ID
CVE-2026-107843
Package
contao/core-bundle
Affected versions
>=4.1.0
Patched versions
5.3.50, 5.7.12
Security advisory
by Leo Feyer
Cross-site request forgery in custom backend actions
Date
25.08.2026
CVE ID
CVE-2026-107848
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
5.3.50, 5.7.12
Security advisory
by Leo Feyer
Path traversal in the images controller
Date
25.08.2026
CVE ID
CVE-2026-107844
Package
contao/core-bundle
Affected versions
>=5.0.0
Patched versions
5.3.50, 5.7.12
Security advisory
by Leo Feyer
Cross-site scripting in the comments bundle
Date
25.08.2026
CVE ID
CVE-2026-107845
Package
contao/comments-bundle
Affected versions
>=4.0.0
Patched versions
5.3.50, 5.7.12
Security advisory
by Leo Feyer
Improper access control in the preview links module
Date
25.08.2026
CVE ID
CVE-2026-107850
Package
contao/core-bundle
Affected versions
>=5.7.1
Patched versions
5.7.12
Security advisory
by Leo Feyer
Cross-site scripting in the frontend search results
Date
25.08.2026
CVE ID
CVE-2026-104884
Package
contao/core-bundle
Affected versions
>=4.9.0
Patched versions
5.3.50, 5.7.12
Security advisory
by Leo Feyer
Non-admin users can self-grant permissions that implicitly make them administrators
Date
25.08.2026
CVE ID
CVE-2026-104883
Package
contao/core-bundle
Affected versions
>=5.0.0
Patched versions
5.3.50, 5.7.12
Security advisory
by Leo Feyer
Improper access control in the CSV import wizard
Date
25.08.2026
CVE ID
CVE-2026-104882
Package
contao/core-bundle
Affected versions
>=5.0.0
Patched versions
5.3.50, 5.7.12
Security advisory
by Leo Feyer
Improper access control in the newsletter module
Date
25.08.2026
CVE ID
CVE-2026-104881
Package
contao/newsletter-bundle
Affected versions
>=5.0.0
Patched versions
5.3.50, 5.7.12
Security advisory