Skip to content
OpenAdvisories
High WID-SEC-2026-4516 3 CVEs

Contao: Mehrere Schwachstellen

Published Nov 10, 2026 · Updated Nov 12, 2026 · Revision 3 · de

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Informationen zu erlangen, Dateien zu manipulieren oder Cross-site-scripting auszuführen.

Product

Contao ist ein Open Source Content Management System zur Erstellung von Websites und Webanwendungen.

Vulnerabilities 3

  • High 7.1
    CVE-2026-126662

    Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple

    Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Atta…

    contao contao
  • Medium 5.3
    CVE-2026-126663

    Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that al…

    contao contao
  • Low 3.7
    CVE-2026-128335

    Contao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change

    Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor stat…

    contao contao

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-128335, EUVD-2026-125042

  2. #2

    Referenz(en) aufgenommen: CVE-2026-126663, EUVD-2026-123405, CVE-2026-126662, EUVD-2026-123404

  3. #1

    Initiale Fassung

References