What is the CVSS score of CVE-2026-57232?

CVE-2026-57232 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-57232?

Yes, a patch is available for CVE-2026-57232. Update the affected software to the latest version immediately.

Contao CMS CVE-2026-57232

EUVD-2026-51596 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-31 GitHub_M

PHP SSRF Contao

3.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Network vector for web-accessible backend; AC:H for module-deploy dependency; PR:L for required backend credentials; C:L for internal service response exposure only.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 31, 2026 - 19:32 vuln.today

Analysis Generated

Jul 31, 2026 - 19:32 vuln.today

Patch available

Jul 31, 2026 - 19:02 EUVD

DescriptionCVE.org

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this->feedIo->read($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.

AnalysisAI

Server-Side Request Forgery in Contao CMS's Feed Reader front-end module enables authenticated backend users to pivot the web server against internal network resources, cloud metadata endpoints, or loopback services. Affected are Contao 5.3.35-5.3.47 and 5.7.0-RC1-5.7.8; exploitation requires a backend account with module-edit permissions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; risk is primarily relevant to multi-tenant or SaaS Contao deployments where untrusted backend users exist.

Technical ContextAI

Contao is a PHP-based open-source CMS (CPE: cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*) that includes a Feed Reader front-end module implemented in core-bundle/src/Controller/FrontendModule/FeedReaderController.php. The vulnerability (CWE-918, Server-Side Request Forgery) arises because FeedReaderController::getResponse() iterates over administrator-configured RSS feed URLs and passes each directly to feedIo->read($url, new Feed()), which internally delegates to Symfony's HttpClient wired as @psr18.http_client. Neither the DCA field definition for rss_feed in tl_module.php nor the HTTP client layer enforces URL scheme allowlisting or private-address blocking. Symfony ships a NoPrivateNetworkHttpClient decorator but it was not applied. The fix (commits 27f6201 and 53b939f) introduces a custom NoPrivateNetworkExceptRootPagesHttpClient that wraps the base HttpClient, performs DNS resolution, checks resolved IPs against private/loopback ranges via Symfony's IpUtils, and re-checks on redirects - replacing the bare @psr18.http_client reference in services.yaml.

RemediationAI

Upgrade Contao to version 5.3.48 (for the 5.3.x branch) or 5.7.9 (for the 5.7.x branch); these versions wire the Feed Reader's HTTP client through the new NoPrivateNetworkExceptRootPagesHttpClient, blocking requests to private, loopback, and link-local addresses. Patch commits are available at https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f and https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4. If immediate patching is not possible, remove or disable all Feed Reader front-end modules from active page layouts; this eliminates the attack surface at the cost of losing RSS aggregation functionality. Alternatively, restrict backend module-edit permissions exclusively to fully trusted administrators, which raises the effective privilege bar and reduces the realistic attacker pool. Deploying a WAF or egress firewall rule blocking server-originated HTTP requests to RFC-1918 ranges and link-local addresses (169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) provides defense-in-depth but does not address the root cause.