DeutschShown in its original language — a full translation is planned for a future version.
Contao: Mehrere Schwachstellen
view advisory published 2026-08-24
Ein Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Berechtigungen zu erweitern und möglicherweise Administratorrechte zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, sensible Informationen offenzulegen und Daten zu manipulieren.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-107851US | —OT elevated | — | ||
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches aut… | ||||
| CVE-2026-107850US | —OT elevated | — | ||
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer… | ||||
| CVE-2026-107848US | — | — | ||
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs… | ||||
| CVE-2026-107845US | — | — | ||
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without suffic… | ||||
| CVE-2026-107844US | — | — | ||
Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with… | ||||
| CVE-2026-107843US | — | — | ||
Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing th… | ||||
| CVE-2026-107842US | — | — | ||
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated vis… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-23w9-4pg3-xwm3 vom 2026-08-24external
- GitHub Security Advisory GHSA-3r9g-pfhv-3228 vom 2026-08-24external
- GitHub Security Advisory GHSA-5974-gfqc-wrcm vom 2026-08-24external
- GitHub Security Advisory GHSA-628f-v4f6-p37r vom 2026-08-24external
- GitHub Security Advisory GHSA-9ff2-p842-45wq vom 2026-08-24external
- GitHub Security Advisory GHSA-h57j-5f5m-789v vom 2026-08-24external
- GitHub Security Advisory GHSA-mfxh-vp55-7gc6 vom 2026-08-24external
- GitHub Security Advisory GHSA-mrvp-7wmx-5m4h vom 2026-08-24external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan