CVE-2023-29200
mediumpriority · track · 26EPSS 0.008 · 56 %ileEUUSEPSS · scored 2026-10-28
Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (9)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-fp7q-xhhw-6rj3Path traversal vulnerability in the file manager2023-04-26ghsa · osvUS
### Impact Authenticated users in the back end can list files outside the document root in the file manager. ### Patches Update to Contao 4.9.40, 4.13.21 or 5.1.4. ### Workarounds None. ### References https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://contao.org/en/security-advisories/directory-traversal-in-the-file-managercnnvd
- https://cxsecurity.com/cveshow/CVE-2023-29200/cnnvd
- https://github.com/contao/contao/commit/6f3e705f4ff23f4419563d09d8485793569f31dfcnnvd
- https://github.com/contao/contao/security/advisories/GHSA-fp7q-xhhw-6rj3cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2023-29200cnnvd
- https://contao.org/en/security-advisories/directory-traversal-in-the-file-managerenisa_euvd
- https://github.com/contao/contao/commit/6f3e705f4ff23f4419563d09d8485793569f31dfenisa_euvd
- https://github.com/contao/contao/security/advisories/GHSA-fp7q-xhhw-6rj3enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan