# contao/core-bundle (Packagist) vulnerabilities

40 known vulnerabilities (5 high, 16 medium, 6 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/contao/core-bundle

## Advisories (40)

### [CVE-2026-107851](https://cve.now/CVE-2026-107851): Contao: Improper access control in the table access voter

- Severity: Medium 4.3
- Published: Oct 9, 2026
- Affected: from 5.7.0, fixed in 5.7.12.

### [CVE-2026-107850](https://cve.now/CVE-2026-107850): Contao: Improper access control in the preview links module

- Severity: Medium 4.3
- Published: Oct 9, 2026
- Affected: from 5.7.1, fixed in 5.7.12.

### [CVE-2026-107848](https://cve.now/CVE-2026-107848): Contao: Cross-site request forgery in custom backend actions

- Severity: Low 3.5
- Published: Oct 9, 2026
- Affected: from 4.0.0, fixed in 5.3.50; from 5.4.0-RC1, fixed in 5.7.12.

### [CVE-2026-107844](https://cve.now/CVE-2026-107844): Contao: Path traversal in the images controller

- Severity: Medium 5.3
- Published: Oct 9, 2026
- Affected: from 4.1.0, fixed in 5.3.50; from 5.4.0-RC1, fixed in 5.7.12.

### [CVE-2026-107843](https://cve.now/CVE-2026-107843): Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

- Severity: Medium 5.3
- Published: Oct 9, 2026
- Affected: from 4.1.0, fixed in 5.3.50; from 5.4.0-RC1, fixed in 5.7.12.

### [CVE-2026-107842](https://cve.now/CVE-2026-107842): Contao: Protected page content is disclosed to anonymous visitors after contao.search.index\_protected is disabled

- Severity: Medium 5.3
- Published: Oct 9, 2026
- Affected: from 4.0.0, fixed in 5.3.50; from 5.4.0-RC1, fixed in 5.7.12.

### [CVE-2026-55825](https://cve.now/CVE-2026-55825): Contao: Possible path traversal in job download URIs

- Severity: Low 3.1
- Published: Jul 31, 2026
- Affected: from 5.7.0, fixed in 5.7.7.

### [CVE-2026-55824](https://cve.now/CVE-2026-55824): Contao crawler leaks auth credentials to external hosts

- Severity: Low 2.6
- Published: Jul 31, 2026
- Affected: from 4.13.0, fixed in 5.3.47; from 5.4.0, fixed in 5.7.7.

### [CVE-2026-57232](https://cve.now/CVE-2026-57232): Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

- Severity: Low 3.1
- Published: Jul 31, 2026
- Affected: from 5.3.35, fixed in 5.3.48; from 5.4.0, fixed in 5.7.9.

### [CVE-2025-65961](https://cve.now/CVE-2025-65961): Contao is vulnerable to cross-site scripting in templates

- Severity: Low 3.3
- Published: Nov 25, 2025
- Affected: from 4.0.0, fixed in 4.13.57; from 5.0.0-RC1, fixed in 5.3.42; from 5.4.0-RC1, fixed in 5.6.5.

### [CVE-2025-65960](https://cve.now/CVE-2025-65960): Contao is vulnerable to remote code execution in template closures

- Severity: Medium 6.6
- Published: Nov 25, 2025
- Affected: from 4.0.0, fixed in 4.13.57; from 5.0.0-RC1, fixed in 5.3.42; from 5.4.0-RC1, fixed in 5.6.5.

### [CVE-2025-57759](https://cve.now/CVE-2025-57759): Contao has improper privilege management for page and article fields

- Severity: Medium 4.3
- Published: Aug 28, 2025
- Affected: from 5.3.0, fixed in 5.3.38; from 5.4.0-RC1, fixed in 5.6.1.

### [CVE-2025-57758](https://cve.now/CVE-2025-57758): Contao has improper access control in the back end voters

- Severity: Medium 4.3
- Published: Aug 28, 2025
- Affected: from 5.0.0, fixed in 5.3.38; from 5.4.0-RC1, fixed in 5.6.1.

### [CVE-2025-57757](https://cve.now/CVE-2025-57757): Contao discloses information in the news module

- Severity: Medium 5.3
- Published: Aug 28, 2025
- Affected: from 5.0.0-RC1, fixed in 5.3.38; from 5.4.0-RC1, fixed in 5.6.1.

### [CVE-2025-57756](https://cve.now/CVE-2025-57756): Contao discloses sensitive information in the front end search index

- Severity: Medium 5.3
- Published: Aug 28, 2025
- Affected: from 4.9.14, fixed in 4.13.56; from 5.0.0-RC1, fixed in 5.3.38; from 5.4.0-RC1, fixed in 5.6.1.

### [CVE-2025-29790](https://cve.now/CVE-2025-29790): Contao allows cross-site scripting through SVG uploads

- Severity: Medium 4.8
- Published: Mar 18, 2025
- Affected: from 4.0.0, fixed in 4.13.54; from 5.3.0, fixed in 5.3.30; from 5.4.0, fixed in 5.5.6.

### [CVE-2024-45604](https://cve.now/CVE-2024-45604): Directory traversal in the file selector widget in contao/core-bundle

- Severity: Medium 4.3
- Published: Sep 17, 2024
- Affected: fixed in 4.13.49.

### [CVE-2024-45398](https://cve.now/CVE-2024-45398): Remote command execution through file upload in contao/core-bundle

- Severity: High 8.3
- Published: Sep 17, 2024
- Affected: from 4.0.0, fixed in 4.13.49; from 5.0.0, fixed in 5.3.15; from 5.4.0, fixed in 5.4.3.

### [CVE-2024-45612](https://cve.now/CVE-2024-45612): Insert tag injection via canonical URL in Contao

- Severity: Medium 5.3
- Published: Sep 17, 2024
- Affected: from 4.13.0, fixed in 4.13.49; from 5.0.0, fixed in 5.3.15; from 5.4.0, fixed in 5.4.3.

### [CVE-2024-30262](https://cve.now/CVE-2024-30262): Contao's remember-me tokens will not be cleared after a password change

- Severity: Medium 5.9
- Published: Apr 9, 2024
- Affected: fixed in 4.13.40.

### [CVE-2024-28235](https://cve.now/CVE-2024-28235): Contao possible cookie sharing with external domains while checking protected pages for broken links

- Severity: High 8.4
- Published: Apr 9, 2024
- Affected: from 4.9.0, fixed in 4.13.40; from 5.0.0-RC1, fixed in 5.3.4.

### [CVE-2024-28191](https://cve.now/CVE-2024-28191): Contao may have unencoded insert tags in the frontend

- Severity: Low 3.1
- Published: Apr 9, 2024
- Affected: from 4.0.0, fixed in 4.13.40; from 5.0.0-RC1, fixed in 5.3.4.

### [CVE-2024-28190](https://cve.now/CVE-2024-28190): Contao core bundle vulnerable to cross site scripting in the file manager

- Severity: Medium 5.4
- Published: Apr 9, 2024
- Affected: from 4.0.0, fixed in 4.13.40; from 5.0.0-RC1, fixed in 5.3.4.

### [CVE-2023-36806](https://cve.now/CVE-2023-36806): Contao cross site scripting vulnerability via input unit widget

- Severity: Medium 6.5
- Published: Jul 25, 2023
- Affected: from 4.0.0, fixed in 4.9.42; from 4.10.0, fixed in 4.13.28; from 5.0.0, fixed in 5.1.10.

### [CVE-2022-24899](https://cve.now/CVE-2022-24899): Cross site scripting via canonical tag

- Severity: High 7.2
- Published: May 5, 2022
- Affected: from 4.13.0, fixed in 4.13.3.

### [CVE-2021-35955](https://cve.now/CVE-2021-35955): Contao \>=4.0.0 allows backend XSS via HTML attributes to an HTML field.

- Severity: Unrated
- Published: Aug 12, 2021
- Affected: from 4.0.0, fixed in 4.4.56; from 4.5.0, fixed in 4.9.18; from 4.10.0, fixed in 4.11.7.

### [CVE-2021-37627](https://cve.now/CVE-2021-37627): Privilege escalation via form generator

- Severity: High 8.0
- Published: Aug 11, 2021
- Affected: from 4.0.0, fixed in 4.4.56; from 4.5.0, fixed in 4.9.18; from 4.10.0, fixed in 4.11.7.

### [CVE-2021-37626](https://cve.now/CVE-2021-37626): PHP file inclusion via insert tags

- Severity: High 7.2
- Published: Aug 11, 2021
- Affected: from 4.0.0, fixed in 4.4.56; from 4.5.0, fixed in 4.9.18; from 4.10.0, fixed in 4.11.7.

### [CVE-2021-35210](https://cve.now/CVE-2021-35210): Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS.

- Severity: Unrated
- Published: Jun 23, 2021
- Affected: from 4.5.0, fixed in 4.9.16; from 4.10.0, fixed in 4.11.5.

### [CVE-2020-25768](https://cve.now/CVE-2020-25768): Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation.

- Severity: Unrated
- Published: Oct 7, 2020
- Affected: from 4.0.0, fixed in 4.4.52; from 4.5.0, fixed in 4.9.6; from 4.10.0, fixed in 4.10.1.

### [CVE-2018-10125](https://cve.now/CVE-2018-10125): Contao before 4.5.7 has XSS in the system log.

- Severity: Unrated
- Published: Mar 16, 2020
- Affected: from 4.0.0, fixed in 4.4.18; from 4.5.0, fixed in 4.5.8; from 3.0.0, fixed in 3.5.35.

### [CVE-2019-19745](https://cve.now/CVE-2019-19745): Contao 4.0 through 4.8.5 allows PHP local file inclusion.

- Severity: Unrated
- Published: Dec 17, 2019
- Affected: from 4.0.0, fixed in 4.4.46; from 4.5.0, fixed in 4.8.6.

### [CVE-2019-19714](https://cve.now/CVE-2019-19714): Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output.

- Severity: Unrated
- Published: Dec 17, 2019
- Affected: from 4.8.4, fixed in 4.8.6.

### [CVE-2019-19712](https://cve.now/CVE-2019-19712): Contao 4.0 through 4.8.5 has Insecure Permissions.

- Severity: Unrated
- Published: Dec 17, 2019
- Affected: from 4.0.0, fixed in 4.4.46; from 4.5.0, fixed in 4.8.6.

### [CVE-2019-11512](https://cve.now/CVE-2019-11512): Contao 4.x allows SQL Injection.

- Severity: Unrated
- Published: Jul 9, 2019
- Affected: from 4.1.0, fixed in 4.4.39; from 4.5.0, fixed in 4.7.5.

### [CVE-2017-16558](https://cve.now/CVE-2017-16558): Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.

- Severity: Unrated
- Published: Apr 25, 2019
- Affected: from 4.0.0, fixed in 4.4.8; from 3.0.0, through 3.5.30.

### [CVE-2019-10642](https://cve.now/CVE-2019-10642): Contao 4.7 allows CSRF.

- Severity: Unrated
- Published: Apr 17, 2019
- Affected: from 4.7.0, fixed in 4.7.3.

### [CVE-2019-10643](https://cve.now/CVE-2019-10643): Contao 4.7 allows Use of a Key Past its Expiration Date.

- Severity: Unrated
- Published: Apr 17, 2019
- Affected: from 4.7.0, fixed in 4.7.3.

### [CVE-2019-10641](https://cve.now/CVE-2019-10641): Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.

- Severity: Unrated
- Published: Apr 17, 2019
- Affected: from 4.0.0, fixed in 4.4.37; from 4.5.0, fixed in 4.7.3.

### [CVE-2017-10993](https://cve.now/CVE-2017-10993): Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter…

- Severity: Unrated
- Published: Jul 21, 2017
- Affected: from 4.0.0, fixed in 4.4.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/contao/core-bundle
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.