contao/core-bundle Security Advisories for 5.3.38 (11)
-
Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)
Affected version: >=4.9.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)
Affected version: >=4.1.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)
Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)
Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)
Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)
Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)
Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Server-side request forgery (SSRF) via unvalidated RSS feed URLs
PKSA-yx24-z15d-x2k7 CVE-2026-57232
Affected version: >=5.3.35,<5.3.48|>=5.4.0,<5.7.9
Reported by:
FriendsOfPHP/security-advisories -
[LOW] Credentials disclosure in the crawler
PKSA-f8tt-pn3h-s2tw CVE-2026-55824 GHSA-3mr9-p497-58f6
Affected version: >=4.13.0,<5.3.47|>=5.4.0,<5.7.7
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[LOW] Contao is vulnerable to cross-site scripting in templates
PKSA-3p5h-vgz7-458z CVE-2025-65961 GHSA-68q5-78xp-cwwc
Affected version: >=5.4.0-RC1,<5.6.5|>=5.0.0-RC1,<5.3.42|>=4.0.0,<4.13.57
Reported by:
GitHub -
[MEDIUM] Contao is vulnerable to remote code execution in template closures
PKSA-wjhx-cdbz-9x61 CVE-2025-65960 GHSA-98vj-mm79-v77r
Affected version: >=5.4.0-RC1,<5.6.5|>=5.0.0-RC1,<5.3.42|>=4.0.0,<4.13.57
Reported by:
GitHub