Server-Side Request Forgery (SSRF) in Contao - #VU166053
Published: November 12, 2026
Vulnerability identifier: #VU166053
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to issue server-side requests to arbitrary destinations, including internal services, and disclose internal feed content.
The vulnerability exists due to missing URL scheme validation and private-network restrictions in Contao's legacy RSS reader module (ModuleRssReader) when fetching configured feeds. A remote user can configure an arbitrary feed URL with permission to create or edit front-end modules and trigger page rendering to expose valid RSS or Atom responses publicly or deliver blind requests to other targets.
Affected software
Contao
Remediation
Install security update from vendor's website.
Contao - addressed in versions 5.3.54, 5.7.17, 6.0.6