contao/core-bundle Security Advisories for 5.0.0 (23)
-
[MEDIUM] Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
PKSA-bmqh-y7sv-p1st CVE-2026-107842 GHSA-x2rp-9qf7-2fmq
Affected version: >=5.4.0-RC1,<5.7.12|>=4.0.0,<5.3.50
Reported by:
GitHub -
[MEDIUM] Contao: The registration module re-sends activation mails
PKSA-s71c-hg32-kv3f CVE-2026-107843 GHSA-mfxh-vp55-7gc6
Affected version: >=5.4.0-RC1,<5.7.12|>=4.1.0,<5.3.50
Reported by:
GitHub -
[LOW] Contao: Cross-site request forgery in custom backend actions
PKSA-6ymc-kdpm-qx87 CVE-2026-107848 GHSA-9ff2-p842-45wq
Affected version: >=5.4.0-RC1,<5.7.12|>=4.0.0,<5.3.50
Reported by:
GitHub -
[MEDIUM] Contao: Path traversal in the images controller
PKSA-6j5h-bxmj-94h9 CVE-2026-107844 GHSA-mrvp-7wmx-5m4h
Affected version: >=5.4.0-RC1,<5.7.12|>=4.1.0,<5.3.50
Reported by:
GitHub -
Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)
Affected version: >=4.9.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)
Affected version: >=4.1.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)
Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)
Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)
Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)
Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)
Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
[LOW] Credentials disclosure in the crawler
PKSA-f8tt-pn3h-s2tw CVE-2026-55824 GHSA-3mr9-p497-58f6
Affected version: >=4.13.0,<5.3.47|>=5.4.0,<5.7.7
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[LOW] Contao is vulnerable to cross-site scripting in templates
PKSA-3p5h-vgz7-458z CVE-2025-65961 GHSA-68q5-78xp-cwwc
Affected version: >=5.4.0-RC1,<5.6.5|>=5.0.0-RC1,<5.3.42|>=4.0.0,<4.13.57
Reported by:
GitHub -
[MEDIUM] Contao is vulnerable to remote code execution in template closures
PKSA-wjhx-cdbz-9x61 CVE-2025-65960 GHSA-98vj-mm79-v77r
Affected version: >=5.4.0-RC1,<5.6.5|>=5.0.0-RC1,<5.3.42|>=4.0.0,<4.13.57
Reported by:
GitHub -
[MEDIUM] Contao can disclose sensitive information in the news module
PKSA-v6p5-ssqr-1zcw CVE-2025-57757 GHSA-w53m-gxvg-vx7p
Affected version: >=5.4.0-RC1,<5.6.1|>=5.0.0-RC1,<5.3.38
Reported by:
GitHub -
[MEDIUM] Contao discloses sensitive information in the front end search index
PKSA-66g4-yhz3-k3zh CVE-2025-57756 GHSA-2xmj-8wmq-7475
Affected version: >=5.4.0-RC1,<5.6.1|>=5.0.0-RC1,<5.3.38|>=4.9.14,<4.13.56
Reported by:
GitHub -
[MEDIUM] Contao applies improper access control in the back end voters
PKSA-c2g8-xqxr-4cjw CVE-2025-57758 GHSA-7m47-r75r-cx8v
Affected version: >=5.4.0-RC1,<5.6.1|>=5.0.0,<5.3.38
Reported by:
GitHub -
[MEDIUM] Contao affected by insert tag injection via canonical URL
PKSA-8psg-sb44-9n6y CVE-2024-45612 GHSA-2xpq-xp6c-5mgj
Affected version: >=5.4.0,<5.4.3|>=5.0.0,<5.3.15|>=4.13.0,<4.13.49
Reported by:
GitHub -
[HIGH] Contao affected by remote command execution through file upload
PKSA-5k7g-byhd-8xrm CVE-2024-45398 GHSA-vm6r-j788-hjh5
Affected version: >=5.4.0,<5.4.3|>=5.0.0,<5.3.15|>=4.0.0,<4.13.49
Reported by:
GitHub -
[LOW] Contao: Unencoded insert tags in the frontend
PKSA-rk65-kfm6-21d9 CVE-2024-28191 GHSA-747v-52c4-8vj8
Affected version: >=5.0.0-RC1,<5.3.4|>=4.0.0,<4.13.40
Reported by:
GitHub -
[MEDIUM] Contao: Cross site scripting in the file manager
PKSA-bxmw-zt4x-f182 CVE-2024-28190 GHSA-v24p-7p4j-qvvf
Affected version: >=5.0.0-RC1,<5.3.4|>=4.0.0,<4.13.40
Reported by:
GitHub -
[HIGH] Contao: Possible cookie sharing with external domains while checking protected pages for broken links
PKSA-g1qg-mn7d-638g CVE-2024-28235 GHSA-9jh5-qf84-x6pr
Affected version: >=5.0.0-RC1,<5.3.4|>=4.9.0,<4.13.40
Reported by:
GitHub -
[MEDIUM] Cross site scripting via input unit widget
PKSA-kc45-s13v-qqqk CVE-2023-36806 GHSA-4gpr-p634-922x
Affected version: >=5.0.0,<5.1.10|>=4.10.0,<4.13.28|>=4.0.0,<4.9.42
Reported by:
GitHub