Versions
>= 4.13.0, < 4.13.49
>= 4.10.0, < 4.13.21
>= 4.9.0, < 4.13.40
>= 5.4.0, < 5.4.3
5.3.15
5.4.3
5.0.0
>= 2.0.0, < 4.13.40
< 4.13.49
>=4.0.0, < 4.13.49
< 4.13.3
>= 4.0.0, < 4.9.42
>= 5.0.0, < 5.3.4
5.4.1
< 4.13.40
>= 2.0.0, < 4.9.40
4.13.49
>= 4.5.0, < 4.9.18
>= 4.10.0, < 4.11.7
5.4.0
>= 4.0.0, < 4.4.56
< 4.4.56
prior to 2.11
>= 5.0.0, < 5.1.10
>= 4.10.0, < 4.13.28
>= 5.0.0, < 5.3.15
0
>= 5.0.0-RC1, < 5.3.4
4.13.0
>= 4.0.0, < 4.13.40
4.0.0
>= 5.0.0, < 5.1.4
4.10.0
Recent CVEs
CVE-2024-45965
Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.
CVE-2024-45604
Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.
CVE-2024-45398
Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory.
CVE-2024-45612
Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.
CVE-2024-30262
Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.
CVE-2024-28235
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
CVE-2023-36806
Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.