Contao vulnerabilities
32 CVEs and advisories name Contao as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-107851Contao: Improper access control in the table access voter
- CVE-2026-107850Contao: Improper access control in the preview links module
- CVE-2026-107848Contao: Cross-site request forgery in custom backend actions
- CVE-2026-107845Contao: Cross-site scripting in the comments bundle
- CVE-2026-107844Contao: Path traversal in the images controller
- CVE-2026-107843Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check
- CVE-2026-107842Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
- CVE-2026-55825Contao: Possible path traversal in job download URIs
- CVE-2026-55824Contao crawler leaks auth credentials to external hosts
- CVE-2026-57232Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
- CVE-2025-65961Contao is vulnerable to cross-site scripting in templates
- CVE-2025-65960Contao is vulnerable to remote code execution in template closures
- CVE-2025-57759Contao has improper privilege management for page and article fields
- CVE-2025-57758Contao has improper access control in the back end voters
- CVE-2025-57757Contao discloses information in the news module
- CVE-2025-57756Contao discloses sensitive information in the front end search index
- CVE-2025-29790Contao allows cross-site scripting through SVG uploads
- CVE-2024-45965Contao before 5.5.6 allows XSS via an SVG document.
- CVE-2024-45604Directory traversal in the file selector widget in contao/core-bundle
- CVE-2024-45398Remote command execution through file upload in contao/core-bundle
- CVE-2024-45612Insert tag injection via canonical URL in Contao
- CVE-2024-30262Contao's remember-me tokens will not be cleared after a password change
- CVE-2024-28235Contao possible cookie sharing with external domains while checking protected pages for broken links
- CVE-2024-28234Contao has insufficient BBCode sanitizer
- CVE-2024-28191Contao may have unencoded insert tags in the frontend
- CVE-2024-28190Contao core bundle vulnerable to cross site scripting in the file manager
- CVE-2023-36806Contao cross site scripting vulnerability via input unit widget
- CVE-2023-29200contao/core-bundle has path traversal vulnerability in the file manager
- CVE-2022-24899Cross site scripting via canonical tag
- CVE-2021-37627Privilege escalation via form generator