Description
Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Contao | Contao | 4.0.0 – < 4.13.54, 5.0.0 – < 5.3.30, 5.4.0 – < 5.5.6 | 4.13.54 |