Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.
CVSS Score
4.3
EPSS Score
0.003
Published
2024-09-17
Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.
CVSS Score
5.9
EPSS Score
0.002
Published
2024-04-09
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
CVSS Score
9.8
EPSS Score
0.802
Published
2022-03-18
contao prior to 2.11.4 has a sql injection vulnerability
CVSS Score
8.8
EPSS Score
0.003
Published
2020-01-29