Contao

CVE-2026-55825 Jul 31, 19:07 PHP LOW PATCH GHSA Monitor

Cross-job file read in Contao CMS 5.7.0-5.7.6 allows authenticated backend users to exfiltrate job attachments belonging to other jobs by injecting path traversal sequences into the attachment identifier parameter. The job attachment download controller authorizes only the jobUuid route parameter, then constructs the actual file path by joining that authorized UUID with the attacker-supplied identifier; Contao's VirtualFilesystem::resolve() canonicalizes the combined path but rejects only escapes from the filesystem mount, not cross-job traversals within the mount. No public exploit has been identified at time of analysis, and the CVSS 3.1 Low score of 3.1 reflects meaningful exploitation barriers: backend authentication and prior knowledge of a victim job UUID are both required.

CVE-2026-57232 Jul 31, 18:29 LOW PATCH Monitor

Server-Side Request Forgery in Contao CMS's Feed Reader front-end module enables authenticated backend users to pivot the web server against internal network resources, cloud metadata endpoints, or loopback services. Affected are Contao 5.3.35-5.3.47 and 5.7.0-RC1-5.7.8; exploitation requires a backend account with module-edit permissions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; risk is primarily relevant to multi-tenant or SaaS Contao deployments where untrusted backend users exist.

CVE-2025-65961 Nov 25, 19:15 PHP LOW PATCH Monitor

Contao is an Open Source CMS. Rated low severity (CVSS 3.3), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2025-65960 Nov 25, 19:15 PHP MEDIUM PATCH This Month

Contao is an Open Source CMS. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2025-57759 Aug 28, 17:15 PHP MEDIUM PATCH This Month

Contao is an Open Source CMS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

CVE-2025-57758 Aug 28, 17:15 PHP MEDIUM PATCH This Month

Contao is an Open Source CMS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2025-57757 Aug 28, 17:15 PHP MEDIUM PATCH This Month

Contao is an Open Source CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2025-57756 Aug 28, 17:15 PHP MEDIUM PATCH This Month

Contao is an Open Source CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2025-29790 Mar 18, 19:15 PHP MEDIUM PATCH Monitor

Contao is an Open Source CMS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-45965 Oct 02, 20:15 MEDIUM POC This Month

Contao before 5.5.6 allows XSS via an SVG document. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-45604 Sep 17, 20:15 PHP MEDIUM PATCH This Month

Contao is an Open Source CMS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-45398 Sep 17, 20:15 PHP HIGH PATCH This Week

Contao is an Open Source CMS. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-45612 Sep 17, 19:15 PHP MEDIUM PATCH This Month

Contao is an Open Source CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-30262 Apr 09, 17:16 PHP HIGH PATCH This Week

Contao is an open source content management system. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-28235 Apr 09, 16:15 PHP MEDIUM PATCH This Month

Contao is an open source content management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2024-28234 Apr 09, 14:15 PHP MEDIUM PATCH This Month

Contao is an open source content management system. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-28191 Apr 09, 14:15 PHP MEDIUM PATCH This Month

Contao is an open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-28190 Apr 09, 14:15 PHP MEDIUM PATCH This Month

Contao is an open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-36806 Jul 25, 19:15 PHP MEDIUM POC PATCH This Month

Contao is an open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2023-29200 Apr 25, 18:15 PHP MEDIUM PATCH This Month

Contao is an open source content management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

CVE-2022-24899 May 06, 00:15 PHP MEDIUM POC PATCH This Month

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-26265 Mar 18, 23:15 PHP CRITICAL POC THREAT Act Now

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-35955 Aug 12, 15:15 PHP MEDIUM PATCH This Month

Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-37627 Aug 11, 23:15 PHP HIGH PATCH This Week

Contao is an open source CMS that allows creation of websites and scalable web applications. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-37626 Aug 11, 23:15 PHP HIGH PATCH This Week

Contao is an open source CMS that allows you to create websites and scalable web applications. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-35210 Jun 23, 11:15 PHP MEDIUM PATCH This Month

Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-25768 Oct 07, 21:15 PHP MEDIUM PATCH This Month

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-19745 Dec 17, 15:15 PHP HIGH PATCH This Week

Contao 4.0 through 4.8.5 allows PHP local file inclusion. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2019-19714 Dec 17, 15:15 PHP MEDIUM PATCH This Month

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-19712 Dec 17, 14:15 PHP MEDIUM PATCH This Month

Contao 4.0 through 4.8.5 has Insecure Permissions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-11512 Jul 09, 21:15 PHP CRITICAL PATCH Act Now

Contao 4.x allows SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-10643 Apr 17, 19:29 PHP CRITICAL PATCH Act Now

Contao 4.7 allows Use of a Key Past its Expiration Date. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-10642 Apr 17, 19:29 PHP HIGH PATCH This Week

Contao 4.7 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-10641 Apr 17, 19:29 PHP CRITICAL PATCH Act Now

Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2017-10993 Jul 21, 06:29 PHP HIGH PATCH This Week

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

CVE-2015-0269 May 26, 17:29 PHP MEDIUM PATCH This Month

Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

CVE-2012-1297 Mar 19, 18:55 MEDIUM POC This Month

Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.