Vulnerabilities

TI-2026-70287 CVE-2026-107851 · GHSA-5974-gfqc-wrcm

Contao table access voter reuses cached decisions across tables

LOW 19

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-10-09 Fixed in 5.7.12 CWE-524

TI-2026-70286 CVE-2026-107850 · GHSA-q6wp-fr43-gm9v

Improper access control in Contao preview links module

LOW 19

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-10-09 Fixed in 5.7.12 CWE-639

TI-2026-70285 CVE-2026-107848 · GHSA-9ff2-p842-45wq

Cross-site request forgery in Contao backend actions

LOW 16

Contao is an Open Source CMS.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00115 Published 2026-10-09 Fixed in 5.3.50, 5.7.12 CWE-352

TI-2026-70131 CVE-2026-107845 · GHSA-628f-v4f6-p37r

Cross-site scripting in Contao comments bundle

MEDIUM 42

Contao is an Open Source CMS.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00277 Published 2026-10-09 Fixed in 5.3.50, 5.7.12 CWE-116

TI-2026-70130 CVE-2026-107844 · GHSA-mrvp-7wmx-5m4h

Path traversal in Contao images controller exposes project files

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00312 Published 2026-10-09 Fixed in 5.3.50, 5.7.12 CWE-22

TI-2026-70129 CVE-2026-107843 · GHSA-mfxh-vp55-7gc6

Contao registration form resends activation mails without throttling

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0027 Published 2026-10-09 Fixed in 5.3.50, 5.7.12 CWE-204

TI-2026-70128 CVE-2026-107842 · GHSA-x2rp-9qf7-2fmq

Contao search exposes protected page content to anonymous visitors

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00262 Published 2026-10-09 Fixed in 5.3.50, 5.7.12 CWE-200

TI-2026-40294 CVE-2026-55825 · GHSA-grm4-wm43-9jh5

Contao: Possible path traversal in job download URIs

LOW 15

Contao is an Open Source CMS.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00296 Published 2026-07-31 Fixed in 5.7.7 CWE-22

TI-2026-40293 CVE-2026-55824 · GHSA-3mr9-p497-58f6

Contao crawler leaks auth credentials to external hosts

LOW 13

Contao is an Open Source CMS.

CVSS 3.1LOW 2.6 Network Low privileges User interaction EPSS 0.00243 Published 2026-07-31 Fixed in 5.3.47, 5.7.7 CWE-200

TI-2026-41170 CVE-2026-57232 · GHSA-87mg-5grr-rhwh

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

LOW 15

Contao is an Open Source CMS.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.0029 Published 2026-07-31 Fixed in 5.7.9, 5.3.48 CWE-918

TI-2025-40529 CVE-2025-65961 · GHSA-68q5-78xp-cwwc

Contao is vulnerable to cross-site scripting in templates

LOW 21

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00179 Published 2025-11-25 Fixed in 4.13.57, 5.3.42 +1 CWE-87

TI-2025-40528 CVE-2025-65960 · GHSA-98vj-mm79-v77r

Contao is vulnerable to remote code execution in template closures

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.0019 Published 2025-11-25 Fixed in 4.13.57, 5.3.42 +1 CWE-351

TI-2025-35644 CVE-2025-57759 · GHSA-qqfq-7cpp-hcqj

Contao has improper privilege management for page and article fields

LOW 20

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00257 Published 2025-08-28 Fixed in 5.3.38, 5.6.1 CWE-269

TI-2025-35643 CVE-2025-57758 · GHSA-7m47-r75r-cx8v

Contao has improper access control in the back end voters

LOW 20

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00257 Published 2025-08-28 Fixed in 5.3.38, 5.6.1 CWE-284

TI-2025-35642 CVE-2025-57757 · GHSA-w53m-gxvg-vx7p

Contao discloses information in the news module

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00316 Published 2025-08-28 Fixed in 5.3.38, 5.6.1 CWE-200

TI-2025-35641 CVE-2025-57756 · GHSA-2xmj-8wmq-7475

Contao discloses sensitive information in the front end search index

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00297 Published 2025-08-28 Fixed in 4.13.56, 5.3.38 +1 CWE-200

TI-2025-21201 CVE-2025-29790 · GHSA-vqqr-fgmh-f626

Contao allows cross-site scripting through SVG uploads

LOW 21

Contao is an Open Source CMS.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00225 Published 2025-03-18 Fixed in 4.13.54, 5.3.30 +1 CWE-79

TI-2024-30849 CVE-2024-45965

Unrestricted file upload in Contao

MEDIUM 62

Contao before 5.5.6 allows XSS via an SVG document.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00338 Published 2024-10-02 Fixed in 4.13.54, 5.3.30 +1 CWE-434

TI-2024-30623 CVE-2024-45604 · GHSA-4p75-5p53-65m9

Directory traversal in the file selector widget in contao/core-bundle

LOW 20

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00427 Published 2024-09-17 Fixed in 4.13.49 CWE-22

TI-2024-30447 CVE-2024-45398 · GHSA-vm6r-j788-hjh5

Remote command execution through file upload in contao/core-bundle

MEDIUM 41

Contao is an Open Source CMS.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00532 Published 2024-09-17 Fixed in 4.13.49, 5.3.15 +1 CWE-434

TI-2024-30631 CVE-2024-45612 · GHSA-2xpq-xp6c-5mgj

Insert tag injection via canonical URL in Contao

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00298 Published 2024-09-17 Fixed in 4.13.49, 5.3.15 +1 CWE-20

TI-2024-20008 CVE-2024-30262 · GHSA-r4r6-j2j3-7pp5

Contao's remember-me tokens will not be cleared after a password change

LOW 32

Contao is an open source content management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00551 Published 2024-04-09 Fixed in 4.13.40 CWE-384

TI-2024-18794 CVE-2024-28235 · GHSA-9jh5-qf84-x6pr

Contao possible cookie sharing with external domains while checking protected pages for broken links

LOW 38

Contao is an open source content management system.

CVSS 3.1HIGH 8.4 Network No auth User interaction EPSS 0.00708 Published 2024-04-09 Fixed in 4.13.40, 5.3.4 CWE-200

TI-2024-18793 CVE-2024-28234 · GHSA-j55w-hjpj-825g

Contao has insufficient BBCode sanitizer

LOW 22

Contao is an open source content management system.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00572 Published 2024-04-09 Fixed in 4.13.40, 5.3.4 CWE-74

TI-2024-18767 CVE-2024-28191 · GHSA-747v-52c4-8vj8

Contao may have unencoded insert tags in the frontend

LOW 25

Contao is an open source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00497 Published 2024-04-09 Fixed in 4.13.40, 5.3.4 CWE-74

Vulnerabilities

Filters