Description
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | contao/contao | >= 4.0.0, < 4.4.1 | 4.4.1 | GHSA-x5g4-crxq-qxjx |
| Packagist | contao/core | >= 3.0.0, < 3.5.28 | 3.5.28 | GHSA-x5g4-crxq-qxjx |
| Packagist | contao/core-bundle | >= 4.0.0, < 4.4.1 | 4.4.1 | GHSA-x5g4-crxq-qxjx |