contao/core-bundle (Packagist)
Advisories
82
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.7.12 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require contao/core-bundle:^5.7.12Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-9ff2-p842-45wq Contao: Cross-site request forgery in custom backend actions |
Low EPSS 0.11% |
>= 4.0.0, < 5.3.50 | 5.3.50 |
| GHSA-9ff2-p842-45wq Contao: Cross-site request forgery in custom backend actions |
Low EPSS 0.11% |
>= 5.4.0-RC1, < 5.7.12 | 5.7.12 |
| GHSA-q6wp-fr43-gm9v Contao: Improper access control in the preview links module |
Medium EPSS 0.19% |
>= 5.7.1, < 5.7.12 | 5.7.12 |
| GHSA-5974-gfqc-wrcm Contao: Improper access control in the table access voter |
Medium EPSS 0.19% |
>= 5.7.0, < 5.7.12 | 5.7.12 |
| GHSA-mrvp-7wmx-5m4h Contao: Path traversal in the images controller |
Medium EPSS 0.31% |
>= 4.1.0, < 5.3.50 | 5.3.50 |
| GHSA-mrvp-7wmx-5m4h Contao: Path traversal in the images controller |
Medium EPSS 0.31% |
>= 5.4.0-RC1, < 5.7.12 | 5.7.12 |
| GHSA-mfxh-vp55-7gc6 Contao: The registration module re-sends activation mails |
Medium EPSS 0.27% |
>= 5.4.0-RC1, < 5.7.12 | 5.7.12 |
| GHSA-mfxh-vp55-7gc6 Contao: The registration module re-sends activation mails |
Medium EPSS 0.27% |
>= 4.1.0, < 5.3.50 | 5.3.50 |
| GHSA-x2rp-9qf7-2fmq Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled |
Medium EPSS 0.26% |
>= 4.0.0, < 5.3.50 | 5.3.50 |
| GHSA-x2rp-9qf7-2fmq Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled |
Medium EPSS 0.26% |
>= 5.4.0-RC1, < 5.7.12 | 5.7.12 |
| GHSA-grm4-wm43-9jh5 Contao: Possible path traversal in job download URIs |
Low EPSS 0.30% |
>= 5.7.0, < 5.7.7 | 5.7.7 |
| GHSA-87mg-5grr-rhwh Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module |
Low EPSS 0.29% |
>= 5.3.35, < 5.3.48 | 5.3.48 |
| GHSA-87mg-5grr-rhwh Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module |
Low EPSS 0.29% |
>= 5.4.0, < 5.7.9 | 5.7.9 |
| GHSA-3mr9-p497-58f6 Contao crawler leaks auth credentials to external hosts |
Low EPSS 0.24% |
>= 5.4.0, < 5.7.7 | 5.7.7 |
| GHSA-3mr9-p497-58f6 Contao crawler leaks auth credentials to external hosts |
Low EPSS 0.24% |
>= 4.13.0, < 5.3.47 | 5.3.47 |
| GHSA-68q5-78xp-cwwc Contao is vulnerable to cross-site scripting in templates |
Medium EPSS 0.18% |
>= 5.4.0-RC1, < 5.6.5 | 5.6.5 |
| GHSA-68q5-78xp-cwwc Contao is vulnerable to cross-site scripting in templates |
Medium EPSS 0.18% |
>= 5.0.0-RC1, < 5.3.42 | 5.3.42 |
| GHSA-68q5-78xp-cwwc Contao is vulnerable to cross-site scripting in templates |
Medium EPSS 0.18% |
>= 4.0.0, < 4.13.57 | 4.13.57 |
| GHSA-98vj-mm79-v77r Contao is vulnerable to remote code execution in template closures |
Medium EPSS 0.19% |
>= 4.0.0, < 4.13.57 | 4.13.57 |
| GHSA-98vj-mm79-v77r Contao is vulnerable to remote code execution in template closures |
Medium EPSS 0.19% |
>= 5.0.0-RC1, < 5.3.42 | 5.3.42 |
| GHSA-98vj-mm79-v77r Contao is vulnerable to remote code execution in template closures |
Medium EPSS 0.19% |
>= 5.4.0-RC1, < 5.6.5 | 5.6.5 |
| GHSA-qqfq-7cpp-hcqj Contao does not properly manage privileges for page and article fields |
Medium EPSS 0.26% |
>= 5.4.0-RC1, < 5.6.1 | 5.6.1 |
| GHSA-qqfq-7cpp-hcqj Contao does not properly manage privileges for page and article fields |
Medium EPSS 0.26% |
>= 5.3.0, < 5.3.38 | 5.3.38 |
| GHSA-w53m-gxvg-vx7p Contao can disclose sensitive information in the news module |
Medium EPSS 0.32% |
>= 5.4.0-RC1, < 5.6.1 | 5.6.1 |
| GHSA-w53m-gxvg-vx7p Contao can disclose sensitive information in the news module |
Medium EPSS 0.32% |
>= 5.0.0-RC1, < 5.3.38 | 5.3.38 |
| GHSA-2xmj-8wmq-7475 Contao discloses sensitive information in the front end search index |
Medium EPSS 0.30% |
>= 4.9.14, < 4.13.56 | 4.13.56 |
| GHSA-2xmj-8wmq-7475 Contao discloses sensitive information in the front end search index |
Medium EPSS 0.30% |
>= 5.4.0-RC1, < 5.6.1 | 5.6.1 |
| GHSA-2xmj-8wmq-7475 Contao discloses sensitive information in the front end search index |
Medium EPSS 0.30% |
>= 5.0.0-RC1, < 5.3.38 | 5.3.38 |
| GHSA-7m47-r75r-cx8v Contao applies improper access control in the back end voters |
Medium EPSS 0.26% |
>= 5.4.0-RC1, < 5.6.1 | 5.6.1 |
| GHSA-7m47-r75r-cx8v Contao applies improper access control in the back end voters |
Medium EPSS 0.26% |
>= 5.0.0, < 5.3.38 | 5.3.38 |
| GHSA-vqqr-fgmh-f626 Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads |
Medium EPSS 0.22% |
>= 5.3.0, < 5.3.30 | 5.3.30 |
| GHSA-vqqr-fgmh-f626 Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads |
Medium EPSS 0.22% |
>= 4.0.0, < 4.13.54 | 4.13.54 |
| GHSA-vqqr-fgmh-f626 Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads |
Medium EPSS 0.22% |
>= 5.4.0, < 5.5.6 | 5.5.6 |
| GHSA-2xpq-xp6c-5mgj Contao affected by insert tag injection via canonical URL |
Medium EPSS 0.30% |
>= 4.13.0, < 4.13.49 | 4.13.49 |
| GHSA-2xpq-xp6c-5mgj Contao affected by insert tag injection via canonical URL |
Medium EPSS 0.30% |
>= 5.0.0, < 5.3.15 | 5.3.15 |
| GHSA-2xpq-xp6c-5mgj Contao affected by insert tag injection via canonical URL |
Medium EPSS 0.30% |
>= 5.4.0, < 5.4.3 | 5.4.3 |
| GHSA-4p75-5p53-65m9 Contao affected by directory traversal in the file selector widget |
Medium EPSS 0.43% |
< 4.13.49 | 4.13.49 |
| GHSA-vm6r-j788-hjh5 Contao affected by remote command execution through file upload |
High EPSS 0.53% |
>= 4.0.0, < 4.13.49 | 4.13.49 |
| GHSA-vm6r-j788-hjh5 Contao affected by remote command execution through file upload |
High EPSS 0.53% |
>= 5.4.0, < 5.4.3 | 5.4.3 |
| GHSA-vm6r-j788-hjh5 Contao affected by remote command execution through file upload |
High EPSS 0.53% |
>= 5.0.0, < 5.3.15 | 5.3.15 |
| GHSA-r4r6-j2j3-7pp5 Contao: Remember-me tokens will not be cleared after a password change |
High EPSS 0.50% |
< 4.13.40 | 4.13.40 |
| GHSA-9jh5-qf84-x6pr Contao: Possible cookie sharing with external domains while checking protected pages for broken links |
Medium EPSS 0.71% |
>= 4.9.0, < 4.13.40 | 4.13.40 |
| GHSA-9jh5-qf84-x6pr Contao: Possible cookie sharing with external domains while checking protected pages for broken links |
Medium EPSS 0.71% |
>= 5.0.0-RC1, < 5.3.4 | 5.3.4 |
| GHSA-747v-52c4-8vj8 Contao: Unencoded insert tags in the frontend |
Medium EPSS 0.50% |
>= 4.0.0, < 4.13.40 | 4.13.40 |
| GHSA-747v-52c4-8vj8 Contao: Unencoded insert tags in the frontend |
Medium EPSS 0.50% |
>= 5.0.0-RC1, < 5.3.4 | 5.3.4 |
| GHSA-v24p-7p4j-qvvf Contao: Cross site scripting in the file manager |
Medium EPSS 0.50% |
>= 4.0.0, < 4.13.40 | 4.13.40 |
| GHSA-v24p-7p4j-qvvf Contao: Cross site scripting in the file manager |
Medium EPSS 0.50% |
>= 5.0.0-RC1, < 5.3.4 | 5.3.4 |
| GHSA-4gpr-p634-922x Cross site scripting via input unit widget |
Medium EPSS 0.64% |
>= 4.10.0, < 4.13.28 | 4.13.28 |
| GHSA-4gpr-p634-922x Cross site scripting via input unit widget |
Medium EPSS 0.64% |
>= 4.0.0, < 4.9.42 | 4.9.42 |
| GHSA-4gpr-p634-922x Cross site scripting via input unit widget |
Medium EPSS 0.64% |
>= 5.0.0, < 5.1.10 | 5.1.10 |
| GHSA-vq59-x6mq-4wgw Contao SQL injection in the file manager |
Critical EPSS 1.46% |
>= 4.5.0, < 4.7.5 | 4.7.5 |
| GHSA-vq59-x6mq-4wgw Contao SQL injection in the file manager |
Critical EPSS 1.46% |
>= 4.1.0, < 4.4.39 | 4.4.39 |
| GHSA-w38g-hj45-mjjp Contao SQL injection in the backend and listing module |
Critical EPSS 1.51% |
>= 3.0.0, <= 3.5.30 | No fix yet |
| GHSA-w38g-hj45-mjjp Contao SQL injection in the backend and listing module |
Critical EPSS 1.51% |
>= 4.0.0, < 4.4.8 | 4.4.8 |
| GHSA-m8x6-6r63-qvj2 Cross site scripting via canonical tag in Contao |
High EPSS 4.48% |
>= 4.13.0, < 4.13.3 | 4.13.3 |
| GHSA-hwmh-9jj9-8c9c Contao CSRF Token Bypass |
High EPSS 0.50% |
>= 4.7.0, < 4.7.3 | 4.7.3 |
| GHSA-vcgg-hp4r-87gx Contao Does Not Invalidate Existing Sessions When Password Changes |
Critical EPSS 1.34% |
>= 4.0.0, < 4.4.37 | 4.4.37 |
| GHSA-vcgg-hp4r-87gx Contao Does Not Invalidate Existing Sessions When Password Changes |
Critical EPSS 1.34% |
>= 4.5.0, < 4.7.3 | 4.7.3 |
| GHSA-x5g4-crxq-qxjx Contao Core directory traversal vulnerability |
High EPSS 2.72% |
>= 4.0.0, < 4.4.1 | 4.4.1 |
| GHSA-j99g-qjvx-995g Contao Does Not Expire Tokens Correctly |
Critical EPSS 1.25% |
>= 4.7.0, < 4.7.3 | 4.7.3 |
| GHSA-pj4j-287j-f742 Cross-site Scripting in Contao |
Medium EPSS 0.84% |
>= 4.0.0, < 4.4.18 | 4.4.18 |
| GHSA-pj4j-287j-f742 Cross-site Scripting in Contao |
Medium EPSS 0.84% |
>= 3.0.0, < 3.5.35 | 3.5.35 |
| GHSA-pj4j-287j-f742 Cross-site Scripting in Contao |
Medium EPSS 0.84% |
>= 4.5.0, < 4.5.8 | 4.5.8 |
| GHSA-hr3h-x6gq-rqcp Cross site scripting via HTML attributes in the back end |
Medium EPSS 0.56% |
>= 4.0.0, < 4.4.56 | 4.4.56 |
| GHSA-hr3h-x6gq-rqcp Cross site scripting via HTML attributes in the back end |
Medium EPSS 0.56% |
>= 4.5.0, < 4.9.18 | 4.9.18 |
| GHSA-hr3h-x6gq-rqcp Cross site scripting via HTML attributes in the back end |
Medium EPSS 0.56% |
>= 4.10.0, < 4.11.7 | 4.11.7 |
| GHSA-hq5m-mqmx-fw6m Privilege escalation via form generator |
High EPSS 1.02% |
>= 4.0.0, < 4.4.56 | 4.4.56 |
| GHSA-hq5m-mqmx-fw6m Privilege escalation via form generator |
High EPSS 1.02% |
>= 4.10.0, < 4.11.7 | 4.11.7 |
| GHSA-hq5m-mqmx-fw6m Privilege escalation via form generator |
High EPSS 1.02% |
>= 4.5.0, < 4.9.18 | 4.9.18 |
| GHSA-r6mv-ppjc-4hgr PHP file inclusion via insert tags |
Medium EPSS 1.25% |
>= 4.0.0, < 4.4.56 | 4.4.56 |
| GHSA-r6mv-ppjc-4hgr PHP file inclusion via insert tags |
Medium EPSS 1.25% |
>= 4.10.0, < 4.11.7 | 4.11.7 |
| GHSA-r6mv-ppjc-4hgr PHP file inclusion via insert tags |
Medium EPSS 1.25% |
>= 4.5.0, < 4.9.18 | 4.9.18 |
| GHSA-h58v-c6rf-g9f7 Cross site scripting in the system log |
Medium EPSS 0.74% |
>= 4.5.0, < 4.9.16 | 4.9.16 |
| GHSA-h58v-c6rf-g9f7 Cross site scripting in the system log |
Medium EPSS 0.74% |
>= 4.10.0, < 4.11.5 | 4.11.5 |
| GHSA-f7wm-x4gw-6m23 Contao Insert tag injection in forms |
Medium EPSS 0.82% |
>= 4.5.0, < 4.9.6 | 4.9.6 |
| GHSA-f7wm-x4gw-6m23 Contao Insert tag injection in forms |
Medium EPSS 0.82% |
>= 4.0.0, < 4.4.52 | 4.4.52 |
| GHSA-f7wm-x4gw-6m23 Contao Insert tag injection in forms |
Medium EPSS 0.82% |
>= 4.10.0, < 4.10.1 | 4.10.1 |
| GHSA-jc43-qrrp-98f5 Insert tag injection in the Contao login module |
Medium EPSS 0.82% |
>= 4.8.4, < 4.8.6 | 4.8.6 |
| GHSA-4mvc-qc5w-v5qr Information disclosure in the Contao backend |
Medium EPSS 0.88% |
>= 4.0.0, < 4.4.46 | 4.4.46 |
| GHSA-4mvc-qc5w-v5qr Information disclosure in the Contao backend |
Medium EPSS 0.88% |
>= 4.5.0, < 4.8.6 | 4.8.6 |
| GHSA-wjx8-cgrm-hh8p Unrestricted file uploads in Contao |
High EPSS 1.11% |
>= 4.0.0, < 4.4.46 | 4.4.46 |
| GHSA-wjx8-cgrm-hh8p Unrestricted file uploads in Contao |
High EPSS 1.11% |
>= 4.5.0, < 4.8.6 | 4.8.6 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor