Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
2019
by Leo Feyer
Insert tag injection in the login module
Date
17.12.2019
CVE ID
CVE-2019-19714
Package
contao/core-bundle
Affected versions
>=4.8.4
Patched versions
4.8.6
Security advisory
by Leo Feyer
Information disclosure in the back end
Date
17.12.2019
CVE ID
CVE-2019-19712
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.46, 4.8.6
Security advisory
by Leo Feyer
Unrestricted file uploads
Date
17.12.2019
CVE ID
CVE-2019-19745
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.46, 4.8.6
Security advisory
by Leo Feyer
SQL injection in the file manager
Date
30.04.2019
CVE ID
CVE-2019-11512
Package
contao/core-bundle
Affected versions
>=4.1.0
Patched versions
4.4.39, 4.7.5
Security advisory
by Leo Feyer
Invalidating opt-in tokens
Date
09.04.2019
CVE ID
CVE-2019-10643
Package
contao/core-bundle
Affected versions
>=4.7.0 <4.7.3
Patched versions
4.7.3
Security advisory
by Leo Feyer
Bypassing the request token check
Date
09.04.2019
CVE ID
CVE-2019-10642
Package
contao/core-bundle
Affected versions
>=4.7.0 <4.7.3
Patched versions
4.7.3
Security advisory
by Leo Feyer
Session invalidation upon password changes
Date
09.04.2019
CVE ID
CVE-2019-10641
Package
contao/core-bundle
Affected versions
>=3.0.0
Patched versions
3.5.39, 4.4.37, 4.7.3
Security advisory