Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

contao/core-bundle

40 known vulnerabilities (5 high, 16 medium, 6 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
40 · 5 high, 16 medium, 6 low
Registry
Packagist

Advisories 40

  • CVE-2026-107851Medium 4.3

    Contao: Improper access control in the table access voter

    Affected: from 5.7.0, fixed in 5.7.12.

  • CVE-2026-107850Medium 4.3

    Contao: Improper access control in the preview links module

    Affected: from 5.7.1, fixed in 5.7.12.

  • Contao: Cross-site request forgery in custom backend actions

    Affected: from 4.0.0, fixed in 5.3.50; from 5.4.0-RC1, fixed in 5.7.12.

  • CVE-2026-107844Medium 5.3

    Contao: Path traversal in the images controller

    Affected: from 4.1.0, fixed in 5.3.50; from 5.4.0-RC1, fixed in 5.7.12.

  • CVE-2026-107843Medium 5.3

    Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

    Affected: from 4.1.0, fixed in 5.3.50; from 5.4.0-RC1, fixed in 5.7.12.

  • CVE-2026-107842Medium 5.3

    Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

    Affected: from 4.0.0, fixed in 5.3.50; from 5.4.0-RC1, fixed in 5.7.12.

  • Contao: Possible path traversal in job download URIs

    Affected: from 5.7.0, fixed in 5.7.7.

  • Contao crawler leaks auth credentials to external hosts

    Affected: from 4.13.0, fixed in 5.3.47; from 5.4.0, fixed in 5.7.7.

  • Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

    Affected: from 5.3.35, fixed in 5.3.48; from 5.4.0, fixed in 5.7.9.

  • Contao is vulnerable to cross-site scripting in templates

    Affected: from 4.0.0, fixed in 4.13.57; from 5.0.0-RC1, fixed in 5.3.42; from 5.4.0-RC1, fixed in 5.6.5.

  • CVE-2025-65960Medium 6.6

    Contao is vulnerable to remote code execution in template closures

    Affected: from 4.0.0, fixed in 4.13.57; from 5.0.0-RC1, fixed in 5.3.42; from 5.4.0-RC1, fixed in 5.6.5.

  • CVE-2025-57759Medium 4.3

    Contao has improper privilege management for page and article fields

    Affected: from 5.3.0, fixed in 5.3.38; from 5.4.0-RC1, fixed in 5.6.1.

  • CVE-2025-57758Medium 4.3

    Contao has improper access control in the back end voters

    Affected: from 5.0.0, fixed in 5.3.38; from 5.4.0-RC1, fixed in 5.6.1.

  • CVE-2025-57757Medium 5.3

    Contao discloses information in the news module

    Affected: from 5.0.0-RC1, fixed in 5.3.38; from 5.4.0-RC1, fixed in 5.6.1.

  • CVE-2025-57756Medium 5.3

    Contao discloses sensitive information in the front end search index

    Affected: from 4.9.14, fixed in 4.13.56; from 5.0.0-RC1, fixed in 5.3.38; from 5.4.0-RC1, fixed in 5.6.1.

Show all 40 advisoriesShow fewer advisories
  • CVE-2025-29790Medium 4.8

    Contao allows cross-site scripting through SVG uploads

    Affected: from 4.0.0, fixed in 4.13.54; from 5.3.0, fixed in 5.3.30; from 5.4.0, fixed in 5.5.6.

  • CVE-2024-45604Medium 4.3

    Directory traversal in the file selector widget in contao/core-bundle

    Affected: fixed in 4.13.49.

  • Remote command execution through file upload in contao/core-bundle

    Affected: from 4.0.0, fixed in 4.13.49; from 5.0.0, fixed in 5.3.15; from 5.4.0, fixed in 5.4.3.

  • CVE-2024-45612Medium 5.3

    Insert tag injection via canonical URL in Contao

    Affected: from 4.13.0, fixed in 4.13.49; from 5.0.0, fixed in 5.3.15; from 5.4.0, fixed in 5.4.3.

  • CVE-2024-30262Medium 5.9

    Contao's remember-me tokens will not be cleared after a password change

    Affected: fixed in 4.13.40.

  • Contao possible cookie sharing with external domains while checking protected pages for broken links

    Affected: from 4.9.0, fixed in 4.13.40; from 5.0.0-RC1, fixed in 5.3.4.

  • Contao may have unencoded insert tags in the frontend

    Affected: from 4.0.0, fixed in 4.13.40; from 5.0.0-RC1, fixed in 5.3.4.

  • CVE-2024-28190Medium 5.4

    Contao core bundle vulnerable to cross site scripting in the file manager

    Affected: from 4.0.0, fixed in 4.13.40; from 5.0.0-RC1, fixed in 5.3.4.

  • CVE-2023-36806Medium 6.5

    Contao cross site scripting vulnerability via input unit widget

    Affected: from 4.0.0, fixed in 4.9.42; from 4.10.0, fixed in 4.13.28; from 5.0.0, fixed in 5.1.10.

  • Cross site scripting via canonical tag

    Affected: from 4.13.0, fixed in 4.13.3.

  • Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field.

    Affected: from 4.0.0, fixed in 4.4.56; from 4.5.0, fixed in 4.9.18; from 4.10.0, fixed in 4.11.7.

  • Privilege escalation via form generator

    Affected: from 4.0.0, fixed in 4.4.56; from 4.5.0, fixed in 4.9.18; from 4.10.0, fixed in 4.11.7.

  • PHP file inclusion via insert tags

    Affected: from 4.0.0, fixed in 4.4.56; from 4.5.0, fixed in 4.9.18; from 4.10.0, fixed in 4.11.7.

  • Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS.

    Affected: from 4.5.0, fixed in 4.9.16; from 4.10.0, fixed in 4.11.5.

  • Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation.

    Affected: from 4.0.0, fixed in 4.4.52; from 4.5.0, fixed in 4.9.6; from 4.10.0, fixed in 4.10.1.

  • Contao before 4.5.7 has XSS in the system log.

    Affected: from 4.0.0, fixed in 4.4.18; from 4.5.0, fixed in 4.5.8; from 3.0.0, fixed in 3.5.35.

  • Contao 4.0 through 4.8.5 allows PHP local file inclusion.

    Affected: from 4.0.0, fixed in 4.4.46; from 4.5.0, fixed in 4.8.6.

  • Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output.

    Affected: from 4.8.4, fixed in 4.8.6.

  • Contao 4.0 through 4.8.5 has Insecure Permissions.

    Affected: from 4.0.0, fixed in 4.4.46; from 4.5.0, fixed in 4.8.6.

  • Contao 4.x allows SQL Injection.

    Affected: from 4.1.0, fixed in 4.4.39; from 4.5.0, fixed in 4.7.5.

  • Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.

    Affected: from 4.0.0, fixed in 4.4.8; from 3.0.0, through 3.5.30.

  • Contao 4.7 allows CSRF.

    Affected: from 4.7.0, fixed in 4.7.3.

  • Contao 4.7 allows Use of a Key Past its Expiration Date.

    Affected: from 4.7.0, fixed in 4.7.3.

  • Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.

    Affected: from 4.0.0, fixed in 4.4.37; from 4.5.0, fixed in 4.7.3.

  • Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter…

    Affected: from 4.0.0, fixed in 4.4.1.