Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
2018
by Leo Feyer
Viewing unauthorized records in the back end
Date
13.12.2018
CVE ID
CVE-2018-20028
Package
contao/core-bundle
Affected versions
>=3.0.0
Patched versions
3.5.37, 4.4.31, 4.6.11
Security advisory
by Leo Feyer
Arbitrary code execution in TCPDF
Date
18.09.2018
CVE ID
CVE-2018-17057
Package
contao/core-bundle
Affected versions
>=3.0.0
Patched versions
3.5.36, 4.4.25, 4.6.4
Security advisory
by Leo Feyer
Cross-site scripting in the system log
Date
18.04.2018
CVE ID
CVE-2018-10125
Package
contao/core-bundle
Affected versions
>=3.0.0
Patched versions
3.5.34, 4.4.17, 4.5.7
Security advisory
by Leo Feyer
SQL injection in the newsletter module
Date
18.01.2018
CVE ID
CVE-2018-5478
Package
contao/newsletter-bundle
Affected versions
<3.5.32
Patched versions
3.5.32
Security advisory