Skip to content
OpenAdvisories
Critical · 9.8 CVE-2019-11512 EUVD-2022-5401GHSA-vq59-x6mq-4wgw

Contao SQL injection in the file manager

Published Jul 9, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Package: contao/contao Package: contao/core-bundle Ecosystem: Packagist

Description

Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist contao/contao >= 4.1.0, < 4.4.39 4.4.39 GHSA-vq59-x6mq-4wgw
Packagist contao/contao >= 4.5.0, < 4.7.5 4.7.5 GHSA-vq59-x6mq-4wgw
Packagist contao/core-bundle >= 4.1.0, < 4.4.39 4.4.39 GHSA-vq59-x6mq-4wgw
Packagist contao/core-bundle >= 4.5.0, < 4.7.5 4.7.5 GHSA-vq59-x6mq-4wgw

References