Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
by Leo Feyer
Improper access control in the table access voter
Date
25.08.2026
CVE ID
CVE-2026-107851
Package
contao/core-bundle
Affected versions
>=5.7.0
Patched versions
5.7.12
Security advisory
by Leo Feyer
Server-side request forgery via unvalidated RSS feed URLs
Date
13.07.2026
CVE ID
CVE-2026-57232
Package
contao/core-bundle
Affected versions
>=5.3.35
Patched versions
5.3.48, 5.7.9
Security advisory
by Leo Feyer
Path traversal in the jobs module
Date
15.06.2026
CVE ID
CVE-2026-55825
Package
contao/core-bundle
Affected versions
>=5.7.0
Patched versions
5.7.7
Security advisory
by Leo Feyer
Credentials disclosure in the crawler
Date
15.06.2026
CVE ID
CVE-2026-55824
Package
contao/core-bundle
Affected versions
>=4.13.40
Patched versions
5.3.47, 5.7.7
Security advisory
by Leo Feyer
Cross-site scripting in templates
Date
25.11.2025
CVE ID
CVE-2025-65961
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.13.57, 5.3.42, 5.6.5
Security advisory
by Leo Feyer
Remote code execution in template closures
Date
25.11.2025
CVE ID
CVE-2025-65960
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.13.57, 5.3.42, 5.6.5
Security advisory
by Leo Feyer
Information disclosure in the front end search index
Date
28.08.2025
CVE ID
CVE-2025-57756
Package
contao/core-bundle
Affected versions
>=4.9.14
Patched versions
4.13.56, 5.3.38, 5.6.1
Security advisory
by Leo Feyer
Information disclosure in the news module
Date
28.08.2025
CVE ID
CVE-2025-57757
Package
contao/news-bundle
Affected versions
>=5.0.0
Patched versions
5.3.38, 5.6.1
Security advisory
by Leo Feyer
Improper access control in the back end voters
Date
27.08.2025
CVE ID
CVE-2025-57758
Package
contao/core-bundle
Affected versions
>=5.0.0
Patched versions
5.3.38, 5.6.1
Security advisory
by Leo Feyer
Improper privilege management for page and article fields
Date
28.08.2025
CVE ID
CVE-2025-57759
Package
contao/core-bundle
Affected versions
>=5.3.0
Patched versions
5.3.38, 5.6.1
Security advisory