SB2026111208 - Multiple vulnerabilities in Contao

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111208

SB2026111208 - Multiple vulnerabilities in Contao

Published: November 12, 2026 Updated: November 13, 2026

Security Bulletin ID SB2026111208
CSH Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 9% Medium 27% Low 64%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in another back end user's browser, potentially compromising sensitive information, modifying data, and disrupting availability.

The vulnerability exists due to improper neutralization of crafted filenames in the Contao file manager when rendering stored filenames during back end interactions. A remote user can upload or rename a file with a crafted filename and induce another back end user to perform triggering actions to execute the stored script.


2) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: N/A)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass private-network restrictions through server-side request forgery and disclose sensitive information.

The vulnerability exists due to a time-of-check time-of-use race condition in Contao's NoPrivateNetworkExceptRootPagesHttpClient when handling cached hosts without pinning the checked IP address. A remote user can manipulate hostname resolution between validation and connection to direct requests to private-network resources and potentially disclose sensitive information.


3) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: N/A)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose information such as the Contao version.

The vulnerability exists due to improper neutralization of insert tags in the Contao breadcrumb module when rendering 404 pages. A remote attacker can inject insert tags into these pages to retrieve application information.


4) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in a victim's browser, potentially compromising sensitive information, modifying content, and disrupting availability.

The vulnerability exists due to improper neutralization of input in Contao's {{figure}} insert tag when nested query-string parameters populate FigureBuilder options that are merged into HTML attributes without XSS filtering. A remote user can supply crafted nested parameters and induce a victim to view the resulting content to execute scripts in the affected site's context.


5) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to replace a victim's backend login session.

The vulnerability exists due to insufficient cross-site request forgery protection in the Contao backend login form when processing login requests. A remote user can trick a victim into submitting a crafted cross-site login request to cause session replacement.


6) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication scope restrictions and gain unauthorized access.

The vulnerability exists due to insufficient validation of passkey scope in Contao's passkey authentication when authenticating on websites with frontend member login. A remote attacker can use a registered passkey associated with one scope to authenticate in a different scope under certain circumstances and gain unauthorized access.


7) Improper Removal of Sensitive Information Before Storage or Transfer (CVE-ID: N/A)

CWE-ID: CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain the crawler operator's confidential authentication headers.

The vulnerability exists due to improper removal of sensitive information in the Contao crawler's HTTP client sanitizer when Authorization or Cookie headers are configured as flat strings in contao.crawl.default_http_client_options.headers and external URLs are crawled. A remote user can add hyperlinks or feed URIs pointing to a controlled server in crawled content to receive the configured authentication material when the crawler visits those URLs.


8) Improper access control (CVE-ID: CVE-2026-126662)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to expose protected files for public download and alter synchronization settings for folders outside their assigned filemounts.

The vulnerability exists due to improper access control in Contao's DC_Folder::editAll when processing bulk folder edits without enforcing filemount containment. A remote user can use the editAll flow with table-wide protected or syncExclude field permission to publish (.public) or de-sync (.nosync) arbitrary folders outside their filemounts anywhere under the project root.


9) Path traversal (CVE-ID: CVE-2026-126663)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose the visual content of image-type files outside their granted files/ scope, including above the project root.

The vulnerability exists due to path traversal in Contao's image insert tag when validating raw paths before percent-decoding without enforcing base-directory containment in ImageFactory::create(). A remote user can supply a percent-encoded traversal path through the {{image::*}} insert tag as a content editor to make the server read, resize and serve image-type files outside the permitted directory.


10) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to issue server-side requests to arbitrary destinations, including internal services, and disclose internal feed content.

The vulnerability exists due to missing URL scheme validation and private-network restrictions in Contao's legacy RSS reader module (ModuleRssReader) when fetching configured feeds. A remote user can configure an arbitrary feed URL with permission to create or edit front-end modules and trigger page rendering to expose valid RSS or Atom responses publicly or deliver blind requests to other targets.


11) Improper Neutralization of Alternate XSS Syntax (CVE-ID: N/A)

CWE-ID: CWE-87 - Improper Neutralization of Alternate XSS Syntax

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to manipulate DOM properties and potentially execute arbitrary JavaScript in a victim's browser through cross-site scripting.

The vulnerability exists due to insufficient neutralization of HTML capable of DOM clobbering in Contao's default HTML sanitizer configuration when processing user-supplied content. A remote user can inject crafted HTML into content viewed by a victim to interfere with DOM properties and potentially execute scripts in the affected site's security context.


Remediation

Install update from vendor's website.

References