Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
by Leo Feyer
SQL injection in the file manager
Date
30.04.2019
CVE ID
CVE-2019-11512
Package
contao/core-bundle
Affected versions
>=4.1.0
Patched versions
4.4.39, 4.7.5
Security advisory
by Leo Feyer
Invalidating opt-in tokens
Date
09.04.2019
CVE ID
CVE-2019-10643
Package
contao/core-bundle
Affected versions
>=4.7.0 <4.7.3
Patched versions
4.7.3
Security advisory
by Leo Feyer
Bypassing the request token check
Date
09.04.2019
CVE ID
CVE-2019-10642
Package
contao/core-bundle
Affected versions
>=4.7.0 <4.7.3
Patched versions
4.7.3
Security advisory
by Leo Feyer
Session invalidation upon password changes
Date
09.04.2019
CVE ID
CVE-2019-10641
Package
contao/core-bundle
Affected versions
>=3.0.0
Patched versions
3.5.39, 4.4.37, 4.7.3
Security advisory
by Leo Feyer
Viewing unauthorized records in the back end
Date
13.12.2018
CVE ID
CVE-2018-20028
Package
contao/core-bundle
Affected versions
>=3.0.0
Patched versions
3.5.37, 4.4.31, 4.6.11
Security advisory
by Leo Feyer
Arbitrary code execution in TCPDF
Date
18.09.2018
CVE ID
CVE-2018-17057
Package
contao/core-bundle
Affected versions
>=3.0.0
Patched versions
3.5.36, 4.4.25, 4.6.4
Security advisory
by Leo Feyer
Cross-site scripting in the system log
Date
18.04.2018
CVE ID
CVE-2018-10125
Package
contao/core-bundle
Affected versions
>=3.0.0
Patched versions
3.5.34, 4.4.17, 4.5.7
Security advisory
by Leo Feyer
SQL injection in the newsletter module
Date
18.01.2018
CVE ID
CVE-2018-5478
Package
contao/newsletter-bundle
Affected versions
<3.5.32
Patched versions
3.5.32
Security advisory
by Leo Feyer
SQL injection in the back end search filter and the listing module
Date
15.11.2017
CVE ID
CVE-2017-16558
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.8
Security advisory
by Leo Feyer
PHP file inclusion in the back end
Date
12.07.2017
CVE ID
CVE-2017-10993
Package
contao/core-bundle
Affected versions
>=3.0.0
Patched versions
3.5.27, 4.4.0
Security advisory