Composer contao/core-bundle has 50 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-24899 | Cross site scripting via canonical tag in Contao | high | 7.2 | >=4.13.0 and <4.13.3 | 4.13.3 |
| CVE-2017-10993 | Contao Core directory traversal vulnerability | high | 8.8 | >=4.0.0 and <4.4.1 | 4.4.1 |
| CVE-2017-16558 | Contao SQL injection in the backend and listing module | critical | 9.8 | >=4.0.0 and <4.4.8 or >=3.0.0 and <=3.5.30 | 4.4.8 |
| CVE-2019-11512 | Contao SQL injection in the file manager | critical | 9.8 | >=4.1.0 and <4.4.39 or >=4.5.0 and <4.7.5 or >=4.5.0 and <4.6.0 or >=4.6.0 and <4.7.0 or >=4.7.0 and <4.7.5 | 4.4.39, 4.7.5 |
| CVE-2019-10641 | Contao Does Not Invalidate Existing Sessions When Password Changes | critical | 9.8 | >=4.0.0 and <4.4.37 or >=4.5.0 and <4.7.3 or >=4.5.0 and <4.6.0 or >=4.6.0 and <4.7.0 or >=4.7.0 and <4.7.3 | 4.4.37, 4.7.3 |
| CVE-2019-10643 | Contao Does Not Expire Tokens Correctly | critical | 9.8 | >=4.7.0 and <4.7.3 | 4.7.3 |
| CVE-2021-37626 | PHP file inclusion via insert tags | medium | 6.7 | >=4.0.0 and <4.4.56 or >=4.5.0 and <4.9.18 or >=4.10.0 and <4.11.7 or >=4.5.0 and <4.6.0 or >=4.6.0 and <4.7.0 or >=4.7.0 and <4.8.0 or >=4.8.0 and <4.9.0 or >=4.9.0 and <4.9.18 or >=4.10.0 and <4.11.0 or >=4.11.0 and <4.11.7 | 4.4.56, 4.9.18, 4.11.7 |
| CVE-2019-19745 | Unrestricted file uploads in Contao | high | 8.8 | >=4.0.0 and <4.4.46 or >=4.5.0 and <4.8.6 or >=4.5.0 and <4.6.0 or >=4.6.0 and <4.7.0 or >=4.7.0 and <4.8.0 or >=4.8.0 and <4.8.6 | 4.4.46, 4.8.6 |
| CVE-2021-37627 | Privilege escalation via form generator | high | 8.0 | >=4.0.0 and <4.4.56 or >=4.5.0 and <4.9.18 or >=4.10.0 and <4.11.7 or >=4.5.0 and <4.6.0 or >=4.6.0 and <4.7.0 or >=4.7.0 and <4.8.0 or >=4.8.0 and <4.9.0 or >=4.9.0 and <4.9.18 or >=4.10.0 and <4.11.0 or >=4.11.0 and <4.11.7 | 4.4.56, 4.9.18, 4.11.7 |
| CVE-2019-19712 | Information disclosure in the Contao backend | medium | 5.3 | >=4.0.0 and <4.4.46 or >=4.5.0 and <4.8.6 or >=4.5.0 and <4.6.0 or >=4.6.0 and <4.7.0 or >=4.7.0 and <4.8.0 or >=4.8.0 and <4.8.6 | 4.4.46, 4.8.6 |
| CVE-2018-10125 | Cross-site Scripting in Contao | medium | 6.1 | >=4.0.0 and <4.4.18 or >=4.5.0 and <4.5.8 or >=3.0.0 and <3.5.35 | 4.4.18, 4.5.8, 3.5.35 |
| CVE-2019-19714 | Insert tag injection in the Contao login module | medium | 5.3 | >=4.8.4 and <4.8.6 | 4.8.6 |
| CVE-2020-25768 | Contao Insert tag injection in forms | medium | 5.3 | >=4.0.0 and <4.4.52 or >=4.5.0 and <4.9.6 or >=4.10.0 and <4.10.1 or >=4.5.0 and <4.6.0 or >=4.6.0 and <4.7.0 or >=4.7.0 and <4.8.0 or >=4.8.0 and <4.9.0 or >=4.9.0 and <4.9.6 | 4.4.52, 4.9.6, 4.10.1 |
| CVE-2023-29200 | Directory traversal vulnerability in the file manager | unknown | 0.0 | >=4.9.0 and <4.9.40 or >=4.13.0 and <4.13.21 or >=5.1.0 and <5.1.4 | 4.9.40, 4.13.21, 5.1.4 |
| CVE-2021-35210 | Cross site scripting in the system log | medium | 6.1 | >=4.5.0 and <4.9.16 or >=4.10.0 and <4.11.5 or >=4.10.0 and <4.11.0 or >=4.11.0 and <4.11.5 | 4.9.16, 4.11.5 |
| CVE-2024-28235 | Contao: Possible cookie sharing with external domains while checking protected pages for broken links | high | 8.3 | >=4.9.0 and <4.13.40 or >=5.0.0-RC1 and <5.3.4 | 4.13.40, 5.3.4 |
| CVE-2023-36806 | Cross site scripting via input unit widget | medium | 6.6 | >=4.0.0 and <4.9.42 or >=4.10.0 and <4.13.28 or >=5.0.0 and <5.1.10 | 4.9.42, 4.13.28, 5.1.10 |
| CVE-2021-35955 | Cross site scripting via HTML attributes in the back end | medium | 5.9 | >=4.0.0 and <4.4.56 or >=4.5.0 and <4.9.18 or >=4.10.0 and <4.11.7 or >=4.5.0 and <4.6.0 or >=4.6.0 and <4.7.0 or >=4.7.0 and <4.8.0 or >=4.8.0 and <4.9.0 or >=4.9.0 and <4.9.18 or >=4.10.0 and <4.11.0 or >=4.11.0 and <4.11.7 | 4.4.56, 4.9.18, 4.11.7 |
| CVE-2024-45398 | Contao affected by remote command execution through file upload | high | 8.3 | >=4.0.0 and <4.13.49 or >=5.0.0 and <5.3.15 or >=5.4.0 and <5.4.3 | 4.13.49, 5.3.15, 5.4.3 |
| CVE-2024-28190 | Contao: Cross site scripting in the file manager | medium | 5.4 | >=4.0.0 and <4.13.40 or >=5.0.0-RC1 and <5.3.4 | 4.13.40, 5.3.4 |
| CVE-2019-10642 | Contao CSRF Token Bypass | high | 8.8 | >=4.7.0 and <4.7.3 | 4.7.3 |
| CVE-2024-30262 | Contao: Remember-me tokens will not be cleared after a password change | medium | 5.9 | <4.13.40 | 4.13.40 |
| CVE-2024-28191 | Contao: Unencoded insert tags in the frontend | low | 3.1 | >=4.0.0 and <4.13.40 or >=5.0.0-RC1 and <5.3.4 | 4.13.40, 5.3.4 |
| CVE-2024-45604 | Contao affected by directory traversal in the file selector widget | medium | 4.3 | <4.13.49 | 4.13.49 |
| CVE-2025-57757 | Contao can disclose sensitive information in the news module | medium | 5.3 | >=5.0.0-RC1 and <5.3.38 or >=5.4.0-RC1 and <5.6.1 | 5.3.38, 5.6.1 |
| CVE-2026-107844 | Contao: Path traversal in the images controller | medium | 5.3 | >=4.1.0 and <5.3.50 or >=5.4.0-RC1 and <5.7.12 | 5.3.50, 5.7.12 |
| CVE-2024-45612 | Contao affected by insert tag injection via canonical URL | medium | 5.3 | >=4.13.0 and <4.13.49 or >=5.0.0 and <5.3.15 or >=5.4.0 and <5.4.3 | 4.13.49, 5.3.15, 5.4.3 |
| CVE-2025-57756 | Contao discloses sensitive information in the front end search index | medium | 5.3 | >=4.9.14 and <4.13.56 or >=5.0.0-RC1 and <5.3.38 or >=5.4.0-RC1 and <5.6.1 | 4.13.56, 5.3.38, 5.6.1 |
| CVE-2026-55825 | Contao: Possible path traversal in job download URIs | low | 3.1 | >=5.7.0 and <5.7.7 | 5.7.7 |
| CVE-2026-57232 | Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module | low | 3.1 | >=5.3.35 and <5.3.48 or >=5.4.0 and <5.7.9 | 5.3.48, 5.7.9 |
| CVE-2026-107843 | Contao: The registration module re-sends activation mails | medium | 5.3 | >=4.1.0 and <5.3.50 or >=5.4.0-RC1 and <5.7.12 | 5.3.50, 5.7.12 |
| CVE-2026-107842 | Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled | medium | 5.3 | >=4.0.0 and <5.3.50 or >=5.4.0-RC1 and <5.7.12 | 5.3.50, 5.7.12 |
| CVE-2025-57758 | Contao applies improper access control in the back end voters | medium | 4.3 | >=5.0.0 and <5.3.38 or >=5.4.0-RC1 and <5.6.1 | 5.3.38, 5.6.1 |
| CVE-2025-57759 | Contao does not properly manage privileges for page and article fields | medium | 4.3 | >=5.3.0 and <5.3.38 or >=5.4.0-RC1 and <5.6.1 | 5.3.38, 5.6.1 |
| CVE-2026-55824 | Contao crawler leaks auth credentials to external hosts | low | 2.6 | >=4.13.0 and <5.3.47 or >=5.4.0 and <5.7.7 | 5.3.47, 5.7.7 |
| CVE-2025-29790 | Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads | medium | 0.0 | >=4.0.0 and <4.13.54 or >=5.3.0 and <5.3.30 or >=5.4.0 and <5.5.6 | 4.13.54, 5.3.30, 5.5.6 |
| CVE-2026-107850 | Contao: Improper access control in the preview links module | medium | 4.3 | >=5.7.1 and <5.7.12 | 5.7.12 |
| CVE-2026-107851 | Contao: Improper access control in the table access voter | medium | 4.3 | >=5.7.0 and <5.7.12 | 5.7.12 |
| CVE-2025-65960 | Contao is vulnerable to remote code execution in template closures | medium | 6.6 | >=4.0.0 and <4.13.57 or >=5.0.0-RC1 and <5.3.42 or >=5.4.0-RC1 and <5.6.5 | 4.13.57, 5.3.42, 5.6.5 |
| CVE-2025-65961 | Contao is vulnerable to cross-site scripting in templates | low | 3.3 | >=4.0.0 and <4.13.57 or >=5.0.0-RC1 and <5.3.42 or >=5.4.0-RC1 and <5.6.5 | 4.13.57, 5.3.42, 5.6.5 |
| CVE-2026-107848 | Contao: Cross-site request forgery in custom backend actions | low | 3.5 | >=4.0.0 and <5.3.50 or >=5.4.0-RC1 and <5.7.12 | 5.3.50, 5.7.12 |
| 2026-08-25-1 | Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm) | unknown | 0.0 | >=5.7.0 and <5.7.12 | 5.7.12 |
| 2026-08-25-2 | Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3) | unknown | 0.0 | >=5.0.0 and <5.3.50 or >=5.4.0 and <5.7.12 | 5.3.50, 5.7.12 |
| 2026-08-25-3 | Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369) | unknown | 0.0 | >=5.0.0 and <5.3.50 or >=5.4.0 and <5.7.12 | 5.3.50, 5.7.12 |
| 2026-08-25-4 | Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v) | unknown | 0.0 | >=4.9.0 and <5.3.50 or >=5.4.0 and <5.7.12 | 5.3.50, 5.7.12 |
| 2026-08-25-5 | Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v) | unknown | 0.0 | >=5.7.1 and <5.7.12 | 5.7.12 |
| 2026-08-25-6 | Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h) | unknown | 0.0 | >=5.0.0 and <5.3.50 or >=5.4.0 and <5.7.12 | 5.3.50, 5.7.12 |
| 2026-08-25-7 | Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq) | unknown | 0.0 | >=4.0.0 and <5.3.50 or >=5.4.0 and <5.7.12 | 5.3.50, 5.7.12 |
| 2026-08-25-8 | Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6) | unknown | 0.0 | >=4.1.0 and <5.3.50 or >=5.4.0 and <5.7.12 | 5.3.50, 5.7.12 |
| 2026-08-25-9 | Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq) | unknown | 0.0 | >=4.0.0 and <5.3.50 or >=5.4.0 and <5.7.12 | 5.3.50, 5.7.12 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked