contao/contao (Packagist)
Advisories
52
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.7.9 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require contao/contao:^5.7.9Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-grm4-wm43-9jh5 Contao: Possible path traversal in job download URIs |
Low EPSS 0.30% |
>= 5.7.0, < 5.7.7 | 5.7.7 |
| GHSA-87mg-5grr-rhwh Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module |
Low EPSS 0.29% |
>= 5.4.0, < 5.7.9 | 5.7.9 |
| GHSA-87mg-5grr-rhwh Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module |
Low EPSS 0.29% |
>= 5.3.35, < 5.3.48 | 5.3.48 |
| GHSA-3mr9-p497-58f6 Contao crawler leaks auth credentials to external hosts |
Low EPSS 0.24% |
>= 5.4.0, < 5.7.7 | 5.7.7 |
| GHSA-3mr9-p497-58f6 Contao crawler leaks auth credentials to external hosts |
Low EPSS 0.24% |
>= 4.13.0, < 5.3.47 | 5.3.47 |
| GHSA-qqfq-7cpp-hcqj Contao does not properly manage privileges for page and article fields |
Medium EPSS 0.26% |
>= 5.3.0, < 5.3.38 | 5.3.38 |
| GHSA-qqfq-7cpp-hcqj Contao does not properly manage privileges for page and article fields |
Medium EPSS 0.26% |
>= 5.4.0-RC1, < 5.6.1 | 5.6.1 |
| GHSA-w53m-gxvg-vx7p Contao can disclose sensitive information in the news module |
Medium EPSS 0.32% |
>= 5.4.0-RC1, < 5.6.1 | 5.6.1 |
| GHSA-w53m-gxvg-vx7p Contao can disclose sensitive information in the news module |
Medium EPSS 0.32% |
>= 5.0.0-RC1, < 5.3.38 | 5.3.38 |
| GHSA-2xmj-8wmq-7475 Contao discloses sensitive information in the front end search index |
Medium EPSS 0.30% |
>= 5.4.0-RC1, < 5.6.1 | 5.6.1 |
| GHSA-2xmj-8wmq-7475 Contao discloses sensitive information in the front end search index |
Medium EPSS 0.30% |
>= 4.9.14, < 4.13.56 | 4.13.56 |
| GHSA-2xmj-8wmq-7475 Contao discloses sensitive information in the front end search index |
Medium EPSS 0.30% |
>= 5.0.0-RC1, < 5.3.38 | 5.3.38 |
| GHSA-7m47-r75r-cx8v Contao applies improper access control in the back end voters |
Medium EPSS 0.26% |
>= 5.0.0, < 5.3.38 | 5.3.38 |
| GHSA-7m47-r75r-cx8v Contao applies improper access control in the back end voters |
Medium EPSS 0.26% |
>= 5.4.0-RC1, < 5.6.1 | 5.6.1 |
| GHSA-mrw8-5368-phm3 Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript Withdrawn |
Medium EPSS 0.34% |
<= 5.4.1 | No fix yet |
| GHSA-fp7q-xhhw-6rj3 Path traversal vulnerability in the file manager |
Medium EPSS 0.80% |
>= 4.13.0, < 4.13.21 | 4.13.21 |
| GHSA-fp7q-xhhw-6rj3 Path traversal vulnerability in the file manager |
Medium EPSS 0.80% |
>= 4.9.0, < 4.9.40 | 4.9.40 |
| GHSA-fp7q-xhhw-6rj3 Path traversal vulnerability in the file manager |
Medium EPSS 0.80% |
>= 5.1.0, < 5.1.4 | 5.1.4 |
| GHSA-vq59-x6mq-4wgw Contao SQL injection in the file manager |
Critical EPSS 1.46% |
>= 4.5.0, < 4.7.5 | 4.7.5 |
| GHSA-vq59-x6mq-4wgw Contao SQL injection in the file manager |
Critical EPSS 1.46% |
>= 4.1.0, < 4.4.39 | 4.4.39 |
| GHSA-w38g-hj45-mjjp Contao SQL injection in the backend and listing module |
Critical EPSS 1.51% |
>= 3.0.0, <= 3.5.30 | No fix yet |
| GHSA-w38g-hj45-mjjp Contao SQL injection in the backend and listing module |
Critical EPSS 1.51% |
>= 4.0.0, < 4.4.8 | 4.4.8 |
| GHSA-m8x6-6r63-qvj2 Cross site scripting via canonical tag in Contao |
High EPSS 4.48% |
>= 4.13.0, < 4.13.3 | 4.13.3 |
| GHSA-hwmh-9jj9-8c9c Contao CSRF Token Bypass |
High EPSS 0.50% |
>= 4.7.0, < 4.7.3 | 4.7.3 |
| GHSA-vcgg-hp4r-87gx Contao Does Not Invalidate Existing Sessions When Password Changes |
Critical EPSS 1.34% |
>= 4.5.0, < 4.7.3 | 4.7.3 |
| GHSA-vcgg-hp4r-87gx Contao Does Not Invalidate Existing Sessions When Password Changes |
Critical EPSS 1.34% |
>= 4.0.0, < 4.4.37 | 4.4.37 |
| GHSA-x5g4-crxq-qxjx Contao Core directory traversal vulnerability |
High EPSS 2.72% |
>= 4.0.0, < 4.4.1 | 4.4.1 |
| GHSA-q99w-j4mj-7hj8 Contao Information Disclosure via Access Control Flaws |
Medium EPSS 0.91% |
>= 4.6.0, < 4.6.11 | 4.6.11 |
| GHSA-q99w-j4mj-7hj8 Contao Information Disclosure via Access Control Flaws |
Medium EPSS 0.91% |
>= 3.0.0, < 3.5.37 | 3.5.37 |
| GHSA-q99w-j4mj-7hj8 Contao Information Disclosure via Access Control Flaws |
Medium EPSS 0.91% |
>= 4.4.0, < 4.4.31 | 4.4.31 |
| GHSA-j99g-qjvx-995g Contao Does Not Expire Tokens Correctly |
Critical EPSS 1.25% |
>= 4.7.0, < 4.7.3 | 4.7.3 |
| GHSA-pj4j-287j-f742 Cross-site Scripting in Contao |
Medium EPSS 0.84% |
>= 4.5.0, < 4.5.8 | 4.5.8 |
| GHSA-pj4j-287j-f742 Cross-site Scripting in Contao |
Medium EPSS 0.84% |
>= 4.0.0, < 4.4.18 | 4.4.18 |
| GHSA-hr3h-x6gq-rqcp Cross site scripting via HTML attributes in the back end |
Medium EPSS 0.56% |
>= 4.0.0, < 4.4.56 | 4.4.56 |
| GHSA-hr3h-x6gq-rqcp Cross site scripting via HTML attributes in the back end |
Medium EPSS 0.56% |
>= 4.5.0, < 4.9.18 | 4.9.18 |
| GHSA-hr3h-x6gq-rqcp Cross site scripting via HTML attributes in the back end |
Medium EPSS 0.56% |
>= 4.10.0, < 4.11.7 | 4.11.7 |
| GHSA-hq5m-mqmx-fw6m Privilege escalation via form generator |
High EPSS 1.02% |
>= 4.10.0, < 4.11.7 | 4.11.7 |
| GHSA-hq5m-mqmx-fw6m Privilege escalation via form generator |
High EPSS 1.02% |
>= 4.5.0, < 4.9.18 | 4.9.18 |
| GHSA-hq5m-mqmx-fw6m Privilege escalation via form generator |
High EPSS 1.02% |
>= 4.0.0, < 4.4.56 | 4.4.56 |
| GHSA-r6mv-ppjc-4hgr PHP file inclusion via insert tags |
Medium EPSS 1.25% |
>= 4.5.0, < 4.9.18 | 4.9.18 |
| GHSA-r6mv-ppjc-4hgr PHP file inclusion via insert tags |
Medium EPSS 1.25% |
>= 4.10.0, < 4.11.7 | 4.11.7 |
| GHSA-r6mv-ppjc-4hgr PHP file inclusion via insert tags |
Medium EPSS 1.25% |
>= 4.0.0, < 4.4.56 | 4.4.56 |
| GHSA-h58v-c6rf-g9f7 Cross site scripting in the system log |
Medium EPSS 0.74% |
>= 4.10.0, < 4.11.5 | 4.11.5 |
| GHSA-h58v-c6rf-g9f7 Cross site scripting in the system log |
Medium EPSS 0.74% |
>= 4.5.0, < 4.9.16 | 4.9.16 |
| GHSA-f7wm-x4gw-6m23 Contao Insert tag injection in forms |
Medium EPSS 0.82% |
>= 4.5.0, < 4.9.6 | 4.9.6 |
| GHSA-f7wm-x4gw-6m23 Contao Insert tag injection in forms |
Medium EPSS 0.82% |
>= 4.0.0, < 4.4.52 | 4.4.52 |
| GHSA-f7wm-x4gw-6m23 Contao Insert tag injection in forms |
Medium EPSS 0.82% |
>= 4.10.0, < 4.10.1 | 4.10.1 |
| GHSA-jc43-qrrp-98f5 Insert tag injection in the Contao login module |
Medium EPSS 0.82% |
>= 4.8.4, < 4.8.6 | 4.8.6 |
| GHSA-4mvc-qc5w-v5qr Information disclosure in the Contao backend |
Medium EPSS 0.88% |
>= 4.0.0, < 4.4.46 | 4.4.46 |
| GHSA-4mvc-qc5w-v5qr Information disclosure in the Contao backend |
Medium EPSS 0.88% |
>= 4.5.0, < 4.8.6 | 4.8.6 |
| GHSA-wjx8-cgrm-hh8p Unrestricted file uploads in Contao |
High EPSS 1.11% |
>= 4.0.0, < 4.4.46 | 4.4.46 |
| GHSA-wjx8-cgrm-hh8p Unrestricted file uploads in Contao |
High EPSS 1.11% |
>= 4.5.0, < 4.8.6 | 4.8.6 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor