Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)

PKSA-ncw3-bhm6-s2mg

Affected version: >=4.9.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)

PKSA-dtqn-wjcr-pw7c

Affected version: >=4.1.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)

PKSA-ws7m-s1y9-vkw6

Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)

PKSA-nqyj-w4wy-fs47

Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)

PKSA-3fqv-nq39-s3wg

Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

PKSA-8zc2-xpjt-dfrb

Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)

PKSA-vy31-xjc7-3g2h

Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)

PKSA-2s8k-hn9c-bkvy

Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

PKSA-rfnv-mh54-2pc9

Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

[LOW] Credentials disclosure in the crawler

PKSA-8pr1-zw9p-tzyx CVE-2026-55824 GHSA-3mr9-p497-58f6

Affected version: >=4.13.0,<5.3.47|>=5.4.0,<5.7.7

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Contao can disclose sensitive information in the news module

PKSA-kh11-db67-t9zk CVE-2025-57757 GHSA-w53m-gxvg-vx7p

Affected version: >=5.4.0-RC1,<5.6.1|>=5.0.0-RC1,<5.3.38

Reported by:
GitHub

[MEDIUM] Contao discloses sensitive information in the front end search index

PKSA-34p6-239r-z7w2 CVE-2025-57756 GHSA-2xmj-8wmq-7475

Affected version: >=5.4.0-RC1,<5.6.1|>=5.0.0-RC1,<5.3.38|>=4.9.14,<4.13.56

Reported by:
GitHub

[MEDIUM] Contao applies improper access control in the back end voters

PKSA-ptp8-kf5w-97c9 CVE-2025-57758 GHSA-7m47-r75r-cx8v

Affected version: >=5.4.0-RC1,<5.6.1|>=5.0.0,<5.3.38

Reported by:
GitHub

[HIGH] Directory traversal vulnerability in the file manager

PKSA-3m2g-ygwq-rxnz CVE-2023-29200 GHSA-fp7q-xhhw-6rj3

Affected version: >=4.9.0,<4.9.40|>=4.13.0,<4.13.21|>=5.1.0,<5.1.4

Reported by:
FriendsOfPHP/security-advisories, GitHub