Contao vulnerabilities
We track 4 vulnerabilities in Contao products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest Contao vulnerabilities
- 7.1 High severity
Contao: Missing Authorization
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attac
- 9.3 Critical severity
contao: Improper Neutralization of Input During Web Page Generation
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/
- 8.8 High severity
contao: Unrestricted Upload of File with Dangerous Type
Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to
- 7.1 High severity
Contao is an open source content management system.
Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an accoun