Description
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this->feedIo->read($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| contao | contao | >= 5.7.0-RC1, < 5.7.9, >= 5.3.35, < 5.3.48 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | contao/contao | >= 5.3.35, < 5.3.48 | 5.3.48 | GHSA-87mg-5grr-rhwh |
| Packagist | contao/contao | >= 5.4.0, < 5.7.9 | 5.7.9 | GHSA-87mg-5grr-rhwh |
| Packagist | contao/core-bundle | >= 5.3.35, < 5.3.48 | 5.3.48 | GHSA-87mg-5grr-rhwh |
| Packagist | contao/core-bundle | >= 5.4.0, < 5.7.9 | 5.7.9 | GHSA-87mg-5grr-rhwh |
Advisories 1
- WID-SEC-2026-2287 Contao: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Aug 2, 2026