[ Vendor · 8 CVEs ]
contao
CVEs affecting contao published in the last 30 days, plus any contao CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-107848 | 9 Oct 2026 | CVSS 3.5 | Contao: Cross-site request forgery in custom backend actionsContao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while… | Fix |
| CVE-2026-107850 | 9 Oct 2026 | CVSS 4.3 | Contao: Improper access control in the preview links moduleContao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as… | Fix |
| CVE-2026-107851 | 9 Oct 2026 | CVSS 4.3 | Contao: Improper access control in the table access voterContao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in… | Fix |
| CVE-2026-107842 | 9 Oct 2026 | CVSS 5.3 | Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabledContao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context… | Fix |
| CVE-2026-107843 | 9 Oct 2026 | CVSS 5.3 | Contao: The registration module re-sends activation mailsContao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on… | Fix |
| CVE-2026-107844 | 9 Oct 2026 | CVSS 5.3 | Contao: Path traversal in the images controllerContao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the… | Fix |
| CVE-2026-107845 | 9 Oct 2026 | CVSS 9.3 | Contao: Cross-site scripting in the comments bundleContao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website… | Fix |
| CVE-2026-57232 | 31 Jul 2026 | CVSS 3.1 | Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader ModuleContao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS… | Fix |