Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
2021
by Leo Feyer
Privilege escalation with the form generator
Date
11.08.2021
CVE ID
CVE-2021-37627
Package
contao/core-bundle
Affected versions
<4.11.7
Patched versions
4.4.56, 4.9.18, 4.11.7
Security advisory
by Leo Feyer
PHP file inclusion via insert tags
Date
11.08.2021
CVE ID
CVE-2021-37626
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.56, 4.9.18, 4.11.7
Security advisory
by Leo Feyer
Cross-site scripting via HTML attributes in the back end
Date
11.08.2021
CVE ID
CVE-2021-35955
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.4.56, 4.9.18, 4.11.7
Security advisory
by Leo Feyer
Cross-site scripting in the system log
Date
23.06.2021
CVE ID
CVE-2021-35210
Package
contao/core-bundle
Affected versions
>=4.5.0
Patched versions
4.9.16, 4.11.5
Security advisory