Description
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not adding protected news archives to the news feed page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| contao | contao | >= 5.0.0-RC1, < 5.3.38, >= 5.4.0-RC1, < 5.6.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | contao/contao | >= 5.0.0-RC1, < 5.3.38 | 5.3.38 | GHSA-w53m-gxvg-vx7p |
| Packagist | contao/contao | >= 5.4.0-RC1, < 5.6.1 | 5.6.1 | GHSA-w53m-gxvg-vx7p |
| Packagist | contao/core-bundle | >= 5.0.0-RC1, < 5.3.38 | 5.3.38 | GHSA-w53m-gxvg-vx7p |
| Packagist | contao/core-bundle | >= 5.4.0-RC1, < 5.6.1 | 5.6.1 | GHSA-w53m-gxvg-vx7p |
Advisories 1
- WID-SEC-2025-1920 Contao: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 28, 2025