Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
2026
by Leo Feyer
Improper access control in the table access voter
Date
25.08.2026
CVE ID
CVE-2026-107851
Package
contao/core-bundle
Affected versions
>=5.7.0
Patched versions
5.7.12
Security advisory
by Leo Feyer
Server-side request forgery via unvalidated RSS feed URLs
Date
13.07.2026
CVE ID
CVE-2026-57232
Package
contao/core-bundle
Affected versions
>=5.3.35
Patched versions
5.3.48, 5.7.9
Security advisory
by Leo Feyer
Path traversal in the jobs module
Date
15.06.2026
CVE ID
CVE-2026-55825
Package
contao/core-bundle
Affected versions
>=5.7.0
Patched versions
5.7.7
Security advisory
by Leo Feyer
Credentials disclosure in the crawler
Date
15.06.2026
CVE ID
CVE-2026-55824
Package
contao/core-bundle
Affected versions
>=4.13.40
Patched versions
5.3.47, 5.7.7
Security advisory