contao/core-bundle
[READ-ONLY] Contao Core Bundle
View on Github
Activity
- Latest release
- 3w ago
- Total releases
- 482
- Cadence
- ~4 days
- Last 12 months
- 48
Reach
- Stars
- 123
Details
- License
- unknown
- First release
- Apr 14, 2015
| Version | Released | |
|---|---|---|
6.0.4
patch
|
6.0.4
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.7.15
patch
|
5.7.15
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
6.0.3
patch
|
6.0.3
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.7.14
patch
|
5.7.14
patch
Dependencies (126)
+ 118 more
Changelog
Compare changes
|
|
5.3.52
patch
|
5.3.52
patch
Dependencies (119)
+ 111 more
Changelog
Compare changes
|
|
6.0.2
patch
|
6.0.2
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
6.0.1
patch
|
6.0.1
patch
Dependencies (124)
+ 116 more
Changelog
Compare changes
|
|
5.7.13
patch
|
5.7.13
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.3.51
patch
|
5.3.51
patch
Dependencies (119)
+ 111 more
Changelog
Compare changes
|
|
6.0.0
major
|
6.0.0
major
Dependencies (124)
+ 116 more
Changelog
Compare changes
|
|
5.7.12
patch
|
5.7.12
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.3.50
patch
|
5.3.50
patch
Dependencies (119)
+ 111 more
Changelog
Compare changes
|
|
5.7.11
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev |
5.7.11
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
6.0.0-RC2
pre
|
6.0.0-RC2
pre
Dependencies (124)
+ 116 more
Changelog
Compare changes
|
|
5.7.10
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev |
5.7.10
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.3.49
patch
4 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev |
5.3.49
patch
Dependencies (119)
+ 111 more
Changelog
Compare changes
|
|
6.0.0-RC1
pre
|
6.0.0-RC1
pre
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.7.9
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev |
5.7.9
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.3.48
patch
4 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev |
5.3.48
patch
Dependencies (119)
+ 111 more
Changelog
Compare changes
|
|
5.7.8
patch
7 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev |
5.7.8
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.3.47
patch
5 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev | ||
5.7.7
patch
7 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev |
5.7.7
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.7.6
patch
9 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55825
GHSA-grm4-wm43-9jh5
Aug 06, 2026
Contao: Possible path traversal in job download URIs
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryAn authenticated backend user who can access one job can request an attachment identifier containing The controller authorizes only the This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values. Root Cause
Therefore: canonicalizes to: which remains inside the Recommended FixTreat the attachment identifier as a filename, not a path:
ImpactA low-privileged backend user can read another job's attachment if they know or obtain the target job UUID and attachment filename. Built-in crawler jobs attach CSV logs such as Affected versions
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
5.7.6
patch
Dependencies (124)
+ 116 more
Changelog
Compare changes
|
|
5.7.5
patch
9 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55825
GHSA-grm4-wm43-9jh5
Aug 06, 2026
Contao: Possible path traversal in job download URIs
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryAn authenticated backend user who can access one job can request an attachment identifier containing The controller authorizes only the This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values. Root Cause
Therefore: canonicalizes to: which remains inside the Recommended FixTreat the attachment identifier as a filename, not a path:
ImpactA low-privileged backend user can read another job's attachment if they know or obtain the target job UUID and attachment filename. Built-in crawler jobs attach CSV logs such as Affected versions
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
5.7.5
patch
Dependencies (124)
+ 116 more
Changelog
Compare changes
|
|
5.7.4
patch
9 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55825
GHSA-grm4-wm43-9jh5
Aug 06, 2026
Contao: Possible path traversal in job download URIs
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryAn authenticated backend user who can access one job can request an attachment identifier containing The controller authorizes only the This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values. Root Cause
Therefore: canonicalizes to: which remains inside the Recommended FixTreat the attachment identifier as a filename, not a path:
ImpactA low-privileged backend user can read another job's attachment if they know or obtain the target job UUID and attachment filename. Built-in crawler jobs attach CSV logs such as Affected versions
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
5.7.4
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.3.46
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
5.3.46
patch
Dependencies (119)
+ 111 more
Changelog
Compare changes
|
|
5.7.3
patch
9 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55825
GHSA-grm4-wm43-9jh5
Aug 06, 2026
Contao: Possible path traversal in job download URIs
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryAn authenticated backend user who can access one job can request an attachment identifier containing The controller authorizes only the This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values. Root Cause
Therefore: canonicalizes to: which remains inside the Recommended FixTreat the attachment identifier as a filename, not a path:
ImpactA low-privileged backend user can read another job's attachment if they know or obtain the target job UUID and attachment filename. Built-in crawler jobs attach CSV logs such as Affected versions
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
5.7.3
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.7.2
patch
9 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55825
GHSA-grm4-wm43-9jh5
Aug 06, 2026
Contao: Possible path traversal in job download URIs
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryAn authenticated backend user who can access one job can request an attachment identifier containing The controller authorizes only the This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values. Root Cause
Therefore: canonicalizes to: which remains inside the Recommended FixTreat the attachment identifier as a filename, not a path:
ImpactA low-privileged backend user can read another job's attachment if they know or obtain the target job UUID and attachment filename. Built-in crawler jobs attach CSV logs such as Affected versions
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
5.7.2
patch
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.3.45
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
5.3.45
patch
Dependencies (119)
+ 111 more
Changelog
Compare changes
|
|
5.7.1
patch
9 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107850
GHSA-q6wp-fr43-gm9v
Oct 09, 2026
Contao: Improper access control in the preview links module
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
ImpactA non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with Honesty caveat, stated because it bounds the severity. Affected versions
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55825
GHSA-grm4-wm43-9jh5
Aug 06, 2026
Contao: Possible path traversal in job download URIs
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryAn authenticated backend user who can access one job can request an attachment identifier containing The controller authorizes only the This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values. Root Cause
Therefore: canonicalizes to: which remains inside the Recommended FixTreat the attachment identifier as a filename, not a path:
ImpactA low-privileged backend user can read another job's attachment if they know or obtain the target job UUID and attachment filename. Built-in crawler jobs attach CSV logs such as Affected versions
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.6.11
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
5.6.11
patch
Dependencies (124)
+ 116 more
Changelog
Compare changes
|
|
5.7.0
minor
8 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107851
GHSA-5974-gfqc-wrcm
Oct 09, 2026
Contao: Improper access control in the table access voter
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. Vulnerability DetailsIn plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?" To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about. So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for. Technical detailContao's backend enforces per-table access control through a chain of Symfony security voters. The relevant one is
The cache key, This is made worse by Most database tables in Contao have no second, table-specific check to catch this. Only CreditsThis security vulnerability was found by Sven Jäger of SySS GmbH. Affected versions
5.7.0
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55825
GHSA-grm4-wm43-9jh5
Aug 06, 2026
Contao: Possible path traversal in job download URIs
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryAn authenticated backend user who can access one job can request an attachment identifier containing The controller authorizes only the This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values. Root Cause
Therefore: canonicalizes to: which remains inside the Recommended FixTreat the attachment identifier as a filename, not a path:
ImpactA low-privileged backend user can read another job's attachment if they know or obtain the target job UUID and attachment filename. Built-in crawler jobs attach CSV logs such as Affected versions
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.7.0-RC4
pre
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.7.0-RC3
pre
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.7.0-RC2
pre
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.7.0-RC1
pre
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
5.7.0-RC1
pre
Dependencies (125)
+ 117 more
Changelog
Compare changes
|
|
5.6.10
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.3.44
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
5.3.44
patch
Dependencies (119)
+ 111 more
Changelog
Compare changes
|
|
5.6.9
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.6.8
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.6.7
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.6.6
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.3.43
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
4.13.58
patch
5 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev |
4.13.58
patch
Dependencies (109)
+ 101 more
Changelog
Compare changes
|
|
5.6.5
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
4.13.57
patch
5 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.3.42
patch
6 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev | ||
5.3.41
patch
8 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev
CVE-2025-65961
GHSA-68q5-78xp-cwwc
Nov 25, 2025
Contao is vulnerable to cross-site scripting in templates
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
ImpactIt is possible to inject code into the template output that will be executed in the browser in the front end and back end. PatchesUpdate to Contao 4.13.57, 5.3.42 or 5.6.5. WorkaroundsDo not use the affected templates or patch them manually. Refsourceshttps://contao.org/en/security-advisories/cross-site-scripting-in-templates Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 423 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.2
5.6.3
5.6.4
Fixed in
4.13.57
5.3.42
5.6.5
References Updated Dec 03, 2025 · Source: OSV.dev
CVE-2025-65960
GHSA-98vj-mm79-v77r
Nov 25, 2025
Contao is vulnerable to remote code execution in template closures
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
ImpactBackend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. PatchesUpdate to Contao 4.13.57, 5.3.42 or 5.6.5 WorkaroundsManually patch the Resourceshttps://contao.org/en/security-advisories/remote-code-execution-in-template-closures Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 423 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.2
5.6.3
5.6.4
Fixed in
4.13.57
5.3.42
5.6.5
References
Updated Nov 27, 2025 · Source: OSV.dev | ||
5.6.4
patch
8 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev
CVE-2025-65961
GHSA-68q5-78xp-cwwc
Nov 25, 2025
Contao is vulnerable to cross-site scripting in templates
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
ImpactIt is possible to inject code into the template output that will be executed in the browser in the front end and back end. PatchesUpdate to Contao 4.13.57, 5.3.42 or 5.6.5. WorkaroundsDo not use the affected templates or patch them manually. Refsourceshttps://contao.org/en/security-advisories/cross-site-scripting-in-templates Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 423 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.2
5.6.3
5.6.4
Fixed in
4.13.57
5.3.42
5.6.5
References Updated Dec 03, 2025 · Source: OSV.dev
CVE-2025-65960
GHSA-98vj-mm79-v77r
Nov 25, 2025
Contao is vulnerable to remote code execution in template closures
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
ImpactBackend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. PatchesUpdate to Contao 4.13.57, 5.3.42 or 5.6.5 WorkaroundsManually patch the Resourceshttps://contao.org/en/security-advisories/remote-code-execution-in-template-closures Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 423 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.2
5.6.3
5.6.4
Fixed in
4.13.57
5.3.42
5.6.5
References
Updated Nov 27, 2025 · Source: OSV.dev |
5.6.4
patch
Dependencies (124)
+ 116 more
Changelog
Compare changes
|
|
5.6.3
patch
8 CVEs
CVE-2026-107842
GHSA-x2rp-9qf7-2fmq
Oct 09, 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactDisclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass. CreditsThis security vulnerability was found by @iRevivalx . Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107843
GHSA-mfxh-vp55-7gc6
Oct 09, 2026
Contao: The registration module re-sends activation mails
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAnyone on the internet can make a Contao installation send unlimited mail to an address of their choosing, from the site's own sender and reputation, at one outbound message per HTTP request. That is both a nuisance for the recipient and a deliverability risk for the site operator. The same request is a reliable account oracle for "this address has a pending registration on this site", which is exactly the sort of membership fact a public site is usually expected not to disclose. Honest bound. The target must have an unconfirmed registration, that is Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107848
GHSA-9ff2-p842-45wq
Oct 09, 2026
Contao: Cross-site request forgery in custom backend actions
3.5
/ 10
Low
Network
Low
Low
Required
Unchanged
None
Low
None
ImpactAn attacker who gets a logged in back end user to load a URL performs back end actions as that user, with no token and no confirmation. Because the exposure follows from the dispatch mechanism rather than from one callback, every present and future Honest bound. The victim must be authenticated in the back end and must load the URL, and the reachable actions are limited to the modules that user can access. We have not found a Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 456 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-107844
GHSA-mrvp-7wmx-5m4h
Oct 09, 2026
Contao: Path traversal in the images controller
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
ImpactAny unauthenticated visitor can read files that are deliberately kept outside the document root, anywhere under the project directory, as long as the name ends in one of Honesty caveat, stated because it lowers the severity. The reporter could not use this to read protected member folders: every path below the upload directory returns 500 for the reason given under Details, so the practically reachable set is image typed files outside Affected versions
4.1.0
4.1.1
4.1.2
4.1.3
4.10.0
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
+ 449 more Show less
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.47
5.3.48
5.3.49
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.10
5.7.11
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
Fixed in
5.3.50
5.7.12
References Updated Oct 09, 2026 · Source: OSV.dev
CVE-2026-57232
GHSA-87mg-5grr-rhwh
Sep 24, 2026
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
3.1
/ 10
Low
Network
High
Low
None
Unchanged
Low
None
None
SummaryThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to DetailsIn The DCA field definition for The HTTP client is wired as ImpactThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:
Confirmed in live testing: the server successfully connected to the internal MySQL container ( Remediation
Affected versions
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
+ 65 more Show less
5.3.47
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
Fixed in
5.3.48
5.7.9
References
Updated Sep 24, 2026 · Source: OSV.dev
CVE-2026-55824
GHSA-3mr9-p497-58f6
Aug 06, 2026
Contao crawler leaks auth credentials to external hosts
2.6
/ 10
Low
Network
High
Low
Required
Unchanged
Low
None
None
SummaryContao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes When Technical DetailRoot CauseSymfony HttpClient authentication options are Suggested MitigationStrip the actual Symfony HttpClient authentication option keys from the clean client. Include NTLM as a defensive extension because Symfony documents it as another auth option. Also update the factory test so the mock factory records or preserves Impact
Affected versions
4.13.0
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
+ 207 more Show less
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.57
4.13.58
4.13.6
4.13.7
4.13.8
4.13.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.42
5.3.43
5.3.44
5.3.45
5.3.46
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.10
5.6.11
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.7.0
5.7.0-RC1
5.7.0-RC2
5.7.0-RC3
5.7.0-RC4
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
Fixed in
5.3.47
5.7.7
References
Updated Aug 06, 2026 · Source: OSV.dev
CVE-2025-65961
GHSA-68q5-78xp-cwwc
Nov 25, 2025
Contao is vulnerable to cross-site scripting in templates
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
ImpactIt is possible to inject code into the template output that will be executed in the browser in the front end and back end. PatchesUpdate to Contao 4.13.57, 5.3.42 or 5.6.5. WorkaroundsDo not use the affected templates or patch them manually. Refsourceshttps://contao.org/en/security-advisories/cross-site-scripting-in-templates Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 423 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.2
5.6.3
5.6.4
Fixed in
4.13.57
5.3.42
5.6.5
References Updated Dec 03, 2025 · Source: OSV.dev
CVE-2025-65960
GHSA-98vj-mm79-v77r
Nov 25, 2025
Contao is vulnerable to remote code execution in template closures
6.6
/ 10
Medium
Network
High
High
None
Unchanged
High
High
High
ImpactBackend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. PatchesUpdate to Contao 4.13.57, 5.3.42 or 5.6.5 WorkaroundsManually patch the Resourceshttps://contao.org/en/security-advisories/remote-code-execution-in-template-closures Affected versions
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.0-RC1
4.1.0-beta1
4.1.1
4.1.2
4.1.3
4.10.0
+ 423 more Show less
4.10.0-RC1
4.10.0-RC2
4.10.0-RC3
4.10.0-RC4
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.11.0
4.11.0-RC1
4.11.0-RC2
4.11.1
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.12.0
4.12.0-RC1
4.12.0-RC2
4.12.0-RC3
4.12.1
4.12.2
4.12.3
4.12.4
4.12.5
4.12.6
4.12.7
4.13.0
4.13.0-RC1
4.13.0-RC2
4.13.0-RC3
4.13.1
4.13.10
4.13.11
4.13.12
4.13.13
4.13.14
4.13.15
4.13.16
4.13.17
4.13.18
4.13.19
4.13.2
4.13.20
4.13.21
4.13.22
4.13.23
4.13.24
4.13.25
4.13.26
4.13.27
4.13.28
4.13.29
4.13.3
4.13.30
4.13.31
4.13.32
4.13.33
4.13.34
4.13.35
4.13.36
4.13.37
4.13.38
4.13.39
4.13.4
4.13.40
4.13.41
4.13.42
4.13.43
4.13.44
4.13.45
4.13.46
4.13.47
4.13.48
4.13.49
4.13.5
4.13.50
4.13.51
4.13.52
4.13.53
4.13.54
4.13.55
4.13.56
4.13.6
4.13.7
4.13.8
4.13.9
4.2.0
4.2.0-RC1
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-RC1
4.3.1
4.3.10
4.3.11
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.0-RC1
4.4.0-RC2
4.4.0-beta1
4.4.1
4.4.10
4.4.11
4.4.12
4.4.13
4.4.14
4.4.15
4.4.16
4.4.17
4.4.18
4.4.19
4.4.2
4.4.20
4.4.21
4.4.22
4.4.23
4.4.24
4.4.25
4.4.26
4.4.27
4.4.28
4.4.29
4.4.3
4.4.30
4.4.31
4.4.32
4.4.33
4.4.34
4.4.35
4.4.36
4.4.37
4.4.38
4.4.39
4.4.4
4.4.40
4.4.41
4.4.42
4.4.43
4.4.44
4.4.45
4.4.46
4.4.47
4.4.48
4.4.49
4.4.5
4.4.50
4.4.51
4.4.52
4.4.53
4.4.54
4.4.55
4.4.56
4.4.57
4.4.6
4.4.7
4.4.8
4.4.9
4.5.0
4.5.0-RC1
4.5.0-RC2
4.5.0-beta1
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.0-RC1
4.6.0-RC2
4.6.0-RC3
4.6.1
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.7.0
4.7.0-RC1
4.7.0-RC2
4.7.0-RC3
4.7.0-RC4
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.8.0
4.8.0-RC1
4.8.0-RC2
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.9.0
4.9.0-RC1
4.9.0-RC2
4.9.1
4.9.10
4.9.11
4.9.12
4.9.13
4.9.14
4.9.15
4.9.16
4.9.17
4.9.18
4.9.19
4.9.2
4.9.20
4.9.21
4.9.22
4.9.23
4.9.24
4.9.25
4.9.26
4.9.27
4.9.28
4.9.29
4.9.3
4.9.30
4.9.31
4.9.32
4.9.33
4.9.34
4.9.35
4.9.36
4.9.37
4.9.38
4.9.39
4.9.4
4.9.40
4.9.41
4.9.42
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.0-RC1
5.0.0-RC2
5.0.0-RC3
5.0.0-RC4
5.0.1
5.0.10
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0-RC1
5.1.0-RC2
5.1.0-RC3
5.1.1
5.1.10
5.1.11
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.1.8
5.1.9
5.2.0
5.2.0-RC1
5.2.0-RC2
5.2.0-RC3
5.2.0-RC4
5.2.0-RC5
5.2.0-RC6
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.0-RC1
5.3.0-RC2
5.3.0-RC3
5.3.0-RC4
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.14
5.3.15
5.3.16
5.3.17
5.3.18
5.3.19
5.3.2
5.3.20
5.3.21
5.3.22
5.3.23
5.3.24
5.3.25
5.3.26
5.3.27
5.3.28
5.3.29
5.3.3
5.3.30
5.3.31
5.3.32
5.3.33
5.3.34
5.3.35
5.3.36
5.3.37
5.3.38
5.3.39
5.3.4
5.3.40
5.3.41
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.4.0
5.4.0-RC1
5.4.0-RC2
5.4.0-RC3
5.4.0-RC4
5.4.1
5.4.10
5.4.11
5.4.12
5.4.13
5.4.14
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.5.0
5.5.0-RC1
5.5.0-RC2
5.5.0-RC3
5.5.0-RC4
5.5.1
5.5.10
5.5.11
5.5.12
5.5.13
5.5.14
5.5.15
5.5.16
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.6.0
5.6.0-RC1
5.6.0-RC2
5.6.0-RC3
5.6.1
5.6.2
5.6.3
5.6.4
Fixed in
4.13.57
5.3.42
5.6.5
References
Updated Nov 27, 2025 · Source: OSV.dev |
5.6.3
patch
Dependencies (124)
+ 116 more
Changelog
Compare changes
|