Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
2017
by Leo Feyer
SQL injection in the back end search filter and the listing module
Date
15.11.2017
CVE ID
CVE-2017-16558
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.8
Security advisory
by Leo Feyer
PHP file inclusion in the back end
Date
12.07.2017
CVE ID
CVE-2017-10993
Package
contao/core-bundle
Affected versions
>=3.0.0
Patched versions
3.5.27, 4.4.0
Security advisory