Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
by Leo Feyer
Directory traversal in the file manager
Date
25.04.2023
CVE ID
CVE-2023-29200
Package
contao/core-bundle
Affected versions
>=2.0.0
Patched versions
4.9.40, 4.13.21, 5.1.4
Security advisory
by Leo Feyer
Cross-site scripting via canonical URL
Date
05.05.2022
CVE ID
CVE-2022-24899
Package
contao/core-bundle
Affected versions
>=4.13.0
Patched versions
4.13.3
Security advisory
by Leo Feyer
Privilege escalation with the form generator
Date
11.08.2021
CVE ID
CVE-2021-37627
Package
contao/core-bundle
Affected versions
<4.11.7
Patched versions
4.4.56, 4.9.18, 4.11.7
Security advisory
by Leo Feyer
PHP file inclusion via insert tags
Date
11.08.2021
CVE ID
CVE-2021-37626
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.56, 4.9.18, 4.11.7
Security advisory
by Leo Feyer
Cross-site scripting via HTML attributes in the back end
Date
11.08.2021
CVE ID
CVE-2021-35955
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.56, 4.9.18, 4.11.7
Security advisory
by Leo Feyer
Cross-site scripting in the system log
Date
23.06.2021
CVE ID
CVE-2021-35210
Package
contao/core-bundle
Affected versions
>=4.5.0
Patched versions
4.9.16, 4.11.5
Security advisory
by Leo Feyer
Insert tag injection in forms
Date
24.09.2020
CVE ID
CVE-2020-25768
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.52, 4.9.6, 4.10.1
Security advisory
by Leo Feyer
Insert tag injection in the login module
Date
17.12.2019
CVE ID
CVE-2019-19714
Package
contao/core-bundle
Affected versions
>=4.8.4
Patched versions
4.8.6
Security advisory
by Leo Feyer
Information disclosure in the back end
Date
17.12.2019
CVE ID
CVE-2019-19712
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.46, 4.8.6
Security advisory
by Leo Feyer
Unrestricted file uploads
Date
17.12.2019
CVE ID
CVE-2019-19745
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.46, 4.8.6
Security advisory