Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
2023
by Leo Feyer
Cross-site scripting in widgets with units
Date
25.07.2023
CVE ID
CVE-2023-36806
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.9.42, 4.13.28, 5.1.10
Security advisory
by Leo Feyer
Directory traversal in the file manager
Date
25.04.2023
CVE ID
CVE-2023-29200
Package
contao/core-bundle
Affected versions
>=2.0.0
Patched versions
4.9.40, 4.13.21, 5.1.4
Security advisory