Security advisories

Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.

Cross site scripting via canonical URL

2022-05-05 08:25 by Leo Feyer

Date: 2022-05-05
CVE ID: CVE-2022-24899

Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end).

Privilege escalation with the form generator

2021-08-11 11:13 by Leo Feyer

Date: 2021-08-11
CVE ID: CVE-2021-37627

It is possible for untrusted users to gain administrator rights with the form generator.

PHP file inclusion via insert tags

2021-08-11 11:03 by Leo Feyer

Date: 2021-08-11
CVE ID: CVE-2021-37626

It is possible for untrusted users to load arbitrary PHP files via insert tags.

Cross site scripting via HTML attributes in the back end

2021-08-11 10:48 by Leo Feyer

Date: 2021-08-11
CVE ID: CVE-2021-35955

It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview (back end) and on the website (front end).

Cross site scripting in the system log

2021-06-23 08:38 by Leo Feyer

Date: 2021-06-23
CVE ID: CVE-2021-35210

It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called. The problem affects all Contao versions as of Contao 4.5 and has been fixed in Contao 4.9.16 and 4.11.5.

Insert tag injection in forms

2020-09-24 10:20 by Leo Feyer

Date: 2020-09-24
CVE ID: CVE-2020-25768

It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. The problem affects all Contao versions as of Contao 4.0 and has been fixed in Contao 4.4.52, 4.9.6 and 4.10.1.

Insert tag injection in the login module

2019-12-17 09:29 by Leo Feyer

Date: 2019-12-17
CVE ID: CVE-2019-19714

It is possible to inject insert tags into the login module which will be replaced when the page is rendered. The problem affects Contao 4.8.4 and 4.8.5 and has been fixed in Contao 4.8.6.

Information disclosure in the back end

2019-12-17 08:53 by Leo Feyer

Date: 2019-12-17
CVE ID: CVE-2019-19712

Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. The problem affects all Contao versions as of Contao 4.0 and has been fixed in Contao 4.4.46 and 4.8.6.

Unrestricted file uploads

2019-12-17 08:17 by Leo Feyer

Date: 2019-12-17
CVE ID: CVE-2019-19745

A back end user with access to the form generator can upload arbitrary files and execute them on the server. The problem affects all Contao versions as of Contao 4.0 and has been fixed in Contao 4.4.46 and 4.8.6.

SQL injection in the file manager

2019-04-30 08:32 by Leo Feyer

Date: 2019-04-30
CVE ID: CVE-2019-11512

The search menu of the file manager is vulnerable to SQL injections. The problem affects all Contao versions as of Contao 4.1 and has been fixed in Contao 4.4.39 and 4.7.5.