Security advisories

Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.

2026

by Leo Feyer

Path traversal in the jobs module

Date: 2026-06-15
CVE ID: CVE-2026-55825

It is theoretically possible to download the log file of another job by using a manipulated download URL.

Security advisory

by Leo Feyer

Credentials disclosure in the crawler

Date: 2026-06-15
CVE ID: CVE-2026-55824

If the crawler is set to crawl protected pages, it sends the authorization credentials to externals URLs.

Security advisory

Archive