Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
by Leo Feyer
Cross-site scripting through SVG uploads
Date
18.03.2025
CVE ID
CVE-2025-29790
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.13.54, 5.3.30, 5.5.6
Security advisory
by Leo Feyer
Insert tag injection via canonical URLs
Date
17.09.2024
CVE ID
CVE-2024-45612
Package
contao/core-bundle
Affected versions
>=4.13.0
Patched versions
4.13.49, 5.3.15, 5.4.3
Security advisory
by Leo Feyer
Directory traversal in the FileSelector widget
Date
17.09.2024
CVE ID
CVE-2024-45604
Package
contao/core-bundle
Affected versions
<4.13.49
Patched versions
4.13.49
Security advisory
by Leo Feyer
Remote command execution through file uploads
Date
17.09.2024
CVE ID
CVE-2024-45398
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.13.49, 5.3.15, 5.4.3
Security advisory
by Leo Feyer
Session cookie disclosure in the crawler
Date
09.04.2024
CVE ID
CVE-2024-28235
Package
contao/core-bundle
Affected versions
>=4.9.0
Patched versions
4.13.40, 5.3.4
Security advisory
by Leo Feyer
Cross-site scripting in the file manager
Date
09.04.2024
CVE ID
CVE-2024-28190
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.13.40, 5.3.4
Security advisory
by Leo Feyer
Insert tag injection via the form generator
Date
09.04.2024
CVE ID
CVE-2024-28191
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.13.40, 5.3.4
Security advisory
by Leo Feyer
Remember-me tokens are not cleared after a password change
Date
09.04.2024
CVE ID
CVE-2024-30262
Package
contao/core-bundle
Affected versions
<4.13.40
Patched versions
4.13.40
Security advisory
by Leo Feyer
Insufficient BBCode sanitization
Date
09.04.2024
CVE ID
CVE-2024-28234
Package
contao/comments-bundle
Affected versions
>=2.0.0
Patched versions
4.13.40, 5.3.4
Security advisory
by Leo Feyer
Cross-site scripting in widgets with units
Date
25.07.2023
CVE ID
CVE-2023-36806
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.9.42, 4.13.28, 5.1.10
Security advisory