Improper Removal of Sensitive Information Before Storage or Transfer in Contao - #VU165879
Published: November 11, 2026
Vulnerability identifier: #VU165879
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-212
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to obtain the crawler operator's confidential authentication headers.
The vulnerability exists due to improper removal of sensitive information in the Contao crawler's HTTP client sanitizer when Authorization or Cookie headers are configured as flat strings in contao.crawl.default_http_client_options.headers and external URLs are crawled. A remote user can add hyperlinks or feed URIs pointing to a controlled server in crawled content to receive the configured authentication material when the crawler visits those URLs.
Affected software
Contao
Remediation
Install security update from vendor's website.
Contao - addressed in versions 5.3.54, 5.7.17, 6.0.6