Skip to content
OpenAdvisories
High WID-SEC-2026-2999 7 CVEs

Contao: Mehrere Schwachstellen

Published Aug 24, 2026 · Updated Oct 11, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Berechtigungen zu erweitern und möglicherweise Administratorrechte zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, sensible Informationen offenzulegen und Daten zu manipulieren.

Product

Contao ist ein Open Source Content Management System zur Erstellung von Websites und Webanwendungen.

Vulnerabilities 7

  • Critical 9.3
    CVE-2026-107845

    Contao: Cross-site scripting in the comments bundle

    Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca…

    contao contao contao/comments-bundle Packagist
  • Medium 5.3
    CVE-2026-107842

    Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

    Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. A…

    contao contao contao/core-bundle Packagist
  • Medium 5.3
    CVE-2026-107843

    Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

    Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha re…

    contao contao contao/core-bundle Packagist
  • Medium 5.3
    CVE-2026-107844

    Contao: Path traversal in the images controller

    Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBasePath() to verify that the canonical p…

    contao contao contao/core-bundle Packagist
  • Medium 4.3
    CVE-2026-107850

    Contao: Improper access control in the preview links module

    Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefo…

    contao contao contao/core-bundle Packagist
  • Medium 4.3
    CVE-2026-107851

    Contao: Improper access control in the table access voter

    Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token…

    contao contao contao/core-bundle Packagist
  • Low 3.5
    CVE-2026-107848

    Contao: Cross-site request forgery in custom backend actions

    Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the k…

    contao contao contao/core-bundle Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-107848, EUVD-2026-95979, CVE-2026-107851, EUVD-2026-95981, CVE-2026-107842, EUVD-2026-95961, CVE-2026-107845, EUVD-2026-95975, CVE-2026-107844, EUVD-2026-95974, CVE-2026-107843, EUVD-2026-95973, CVE-2026-107850, EUVD-2026-95980

  2. #1

    Initiale Fassung

References