EUVD-2026-51596
GHSA-87mg-5grr-rhwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege backend user
-
DeliveryNavigate to Feed Reader module configuration
-
ExploitSet RSS feed URL to internal target (e.g., IMDSv1 endpoint or loopback service)
-
ExecutionTrigger front-end page render containing the module
-
PersistServer issues unvalidated outbound HTTP request
-
ImpactAttacker reads internal service response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concurrent conditions: (1) the attacker holds a valid Contao backend account with module-edit permissions (PR:L in CVSS - not anonymous); (2) the Feed Reader front-end module feature is available and not administratively disabled; and (3) the attacker can place an edited module onto a page that the server will render, triggering the outbound HTTP request. Exploitation is limited by: the authentication requirement (eliminates unauthenticated attackers), the need for module-edit permissions specifically (not all authenticated users have this), and AC:H reflecting the dependency on this specific module being deployed. Cloud metadata endpoint exfiltration further requires the Contao server to run in a cloud environment with IMDSv1 enabled. Default Contao installations with a single trusted administrator are not meaningfully at risk. |
| Impact | The official CVSS 3.1 score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the constrained real-world risk: exploitation requires an authenticated backend user (PR:L) and the Feed Reader module must be actively deployed and editable by that user (contributing to AC:H). The confidentiality impact is limited to internal service response data accessible by the server process (C:L), with no integrity or availability impact. No EPSS data was provided in the intelligence; given the low CVSS, authenticated requirement, and absence of public exploit code or CISA KEV listing, automated mass exploitation is implausible. The realistic threat is an insider or a compromised low-privileged backend account probing internal infrastructure or cloud metadata APIs (e.g., AWS IMDSv1 at 169.254.169.254). Risk is elevated in hosted or agency environments where multiple clients or contractors share backend access; it is minimal in single-operator deployments. No conflicting signals between CVSS vector and description were identified. |
| Exploit ScenarioDerived | A backend user with module-edit permissions navigates to the Contao module manager, creates or edits a Feed Reader module, and sets the RSS feed URL to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1) or http://127.0.0.1:8080/internal-api. When a front-end page embedding that module is visited, the Contao server fetches the attacker-specified URL and may return its contents through error messages or cached output, exposing internal service data. No public exploit code is known to exist at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Server-Side Request Forgery in Contao CMS's Feed Reader front-end module enables authenticated backend users to pivot the web server against internal network resources, cloud metadata endpoints, or loopback services. Affected are Contao 5.3.35-5.3.47 and 5.7.0-RC1-5.7.8; exploitation requires a backend account with module-edit permissions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; risk is primarily relevant to multi-tenant or SaaS Contao deployments where untrusted backend users exist.
RemediationAI
Upgrade Contao to version 5.3.48 (for the 5.3.x branch) or 5.7.9 (for the 5.7.x branch); these versions wire the Feed Reader's HTTP client through the new NoPrivateNetworkExceptRootPagesHttpClient, blocking requests to private, loopback, and link-local addresses. Patch commits are available at https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f and https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4. If immediate patching is not possible, remove or disable all Feed Reader front-end modules from active page layouts; this eliminates the attack surface at the cost of losing RSS aggregation functionality. Alternatively, restrict backend module-edit permissions exclusively to fully trusted administrators, which raises the effective privilege bar and reduces the realistic attacker pool. Deploying a WAF or egress firewall rule blocking server-originated HTTP requests to RFC-1918 ranges and link-local addresses (169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) provides defense-in-depth but does not address the root cause.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Contao is a PHP-based open-source CMS (CPE: cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*) that includes a Feed Reader front-end module implemented in core-bundle/src/Controller/FrontendModule/FeedReaderController.php. The vulnerability (CWE-918, Server-Side Request Forgery) arises because FeedReaderController::getResponse() iterates over administrator-configured RSS feed URLs and passes each directly to feedIo->read($url, new Feed()), which internally delegates to Symfony's HttpClient wired as @psr18.http_client. Neither the DCA field definition for rss_feed in tl_module.php nor the HTTP client layer enforces URL scheme allowlisting or private-address blocking. Symfony ships a NoPrivateNetworkHttpClient decorator but it was not applied. The fix (commits 27f6201 and 53b939f) introduces a custom NoPrivateNetworkExceptRootPagesHttpClient that wraps the base HttpClient, performs DNS resolution, checks resolved IPs against private/loopback ranges via Symfony's IpUtils, and re-checks on redirects - replacing the bare @psr18.http_client reference in services.yaml.
Know when Contao gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Network vector for web-accessible backend; AC:H for module-deploy dependency; PR:L for required backend credentials; C:L for internal service response exposure only.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this->feedIo->read($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. Rate
Contao 4.x allows SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no auth
Contao 4.7 allows Use of a Key Past its Expiration Date. Rated critical severity (CVSS 9.8), this vulnerability is remot
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. Rated critica
Contao before 5.5.6 allows XSS via an SVG document. Rated medium severity (CVSS 5.4), this vulnerability is remotely exp
Contao is an open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exp
Unauthenticated path traversal in the Contao CMS ImagesController lets remote attackers read files from the project dire
Stored cross-site scripting in the Contao CMS comments bundle lets an unauthenticated visitor submit a comment whose ema
Information disclosure in Contao CMS allows unauthenticated front-end visitors to read the titles, URLs, and indexed tex
Unauthenticated email-flooding and user-enumeration in Contao CMS: a POST to any page containing the registration module
Exploit-DB