Skip to content
OpenAdvisories
Low WID-SEC-2026-1921 2 CVEs

Contao: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Jun 14, 2026 · Updated Aug 2, 2026 · Revision 3 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um Informationen offenzulegen.

Product

Contao ist ein Open Source Content Management System zur Erstellung von Websites und Webanwendungen.

Vulnerabilities 2

  • Low 3.1
    CVE-2026-55825

    Contao: Possible path traversal in job download URIs

    Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directo…

    contao contao contao/core-bundle contao/contao Packagist
  • Low 2.6
    CVE-2026-55824

    Contao crawler leaks auth credentials to external hosts

    Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creat…

    contao contao contao/core-bundle contao/contao Packagist

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-51620, EUVD-2026-51613

  2. #2

    CVE's ergänzt

  3. #1

    Initiale Fassung

References