Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
40 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module.
Recommended action: Upgrade to 4.4.8; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end). Patches Update to Contao 4.13.3. Workarounds Disable canonical tags in the root page settings. References https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url For more information If you have any questions or comments about this advisory, open an issue in contao/contao.
Recommended action: Upgrade to 4.13.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security researcher Ali Razzaq has discovered that the request token check can be bypassed in Contao 4.7
Recommended action: Upgrade to 4.7.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security researcher Ali Razzaq has discovered that existing sessions are not correctly invalidated when a user changes their password in the backend or frontend.
Recommended action: Upgrade to 4.7.3 or 4.4.37 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A logged in back end user can include arbitrary PHP files by manipulating an URL parameter. Since Contao does not allow to upload PHP files in the file manager, the attack is limited to the existing PHP files on the server.
Recommended action: Upgrade to 4.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security researcher Ali Razzaq has discovered that confirming an opt-in token does not invalidate previous opt-in tokens in Contao 4.7.
Recommended action: Upgrade to 4.7.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Recommended action: Upgrade to 4.5.8, 4.4.18 or 3.5.35 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify HTML fields (e.g. TinyMCE). Patches Update to Contao 4.4.56, 4.9.18 or 4.11.7 Workarounds Disable all fields that allow HTML for untrusted back end users or disable the login for these users. References https://contao.org/en/security-advisories/cross-site-scripting-via-html-attributes-in-the-back-end For more information If you have any questions or comments about this advisory, open an issue in contao/contao. Credits Thanks to Mikhail Khramenkov and Moritz Vondano for reporting this security issue.
Recommended action: Upgrade to 4.11.7, 4.9.18 or 4.4.56 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It is possible for untrusted users to gain administrator rights with the form generator. Installations are only affected if there are untrusted back end users with access to the form generator. Patches Update to Contao 4.4.56, 4.9.18 or 4.11.7. Workarounds Disable the form generator or disable the login for untrusted back end users. References https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator For more information If you have any questions or comments about this advisory, open an issue in contao/contao.
Recommended action: Upgrade to 4.11.7, 4.9.18 or 4.4.56 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It is possible for untrusted users to load arbitrary PHP files via insert tags. Installations are only affected if there are untrusted back end users. Patches Update to Contao 4.4.56, 4.9.18 or 4.11.7. Workarounds Disable the login for untrusted back end users. References https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags For more information If you have any questions or comments about this advisory, open an issue in contao/contao.
Recommended action: Upgrade to 4.11.7, 4.9.18 or 4.4.56 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It is possible to inject code into the tllog table that will be executed in the browser when the system log is called in the back end. Patches Update to Contao 4.9.16 or 4.11.5. Workarounds Disable the system log module in the back end for all users (especially admin users). References https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021 For more information If you have any questions or comments about this advisory, open an issue in contao/contao.
Recommended action: Upgrade to 4.11.5 or 4.9.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Patches Update to Contao 4.4.52, 4.9.6 or 4.10.1. Workarounds Disable the front end login form and do not use form fields with array keys such as fieldname[]. References https://contao.org/en/security-advisories/insert-tag-injection-in-forms For more information If you have any questions or comments about this advisory, open an issue in contao/contao.
Recommended action: Upgrade to 4.10.1, 4.9.6 or 4.4.52 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It is possible to inject insert tags into the login module which will be replaced when the page is rendered. Patches Update to Contao 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module For more information If you have any questions or comments about this advisory, open an issue in contao/contao.
Recommended action: Upgrade to 4.8.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/information-disclosure-in-the-back-end For more information If you have any questions or comments about this advisory, open an issue in contao/contao.
Recommended action: Upgrade to 4.8.6 or 4.4.46 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A back end user with access to the form generator can upload arbitrary files and execute them on the server. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory. References https://contao.org/en/security-advisories/unrestricted-file-uploads For more information If you have any questions or comments about this advisory, open an issue in contao/contao.
Recommended action: Upgrade to 4.8.6 or 4.4.46 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.