Package Instance

Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads
Users can upload SVG files with malicious code, which is then executed in the back end and/or front end.

Cross site scripting via HTML attributes in the back end
It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview (back end) and on the website (front end).

Installations are only affected if there are untrusted back end users who have the rights to modify HTML fields (e.g. TinyMCE).

Cross site scripting in the system log
It is possible to inject code into the `tl_log` table that will be executed in the browser when the system log is called in the back end.

Contao affected by remote command execution through file upload
Back end users with access to the file manager can upload malicious files and execute them on the server.

Contao: Possible cookie sharing with external domains while checking protected pages for broken links
If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs.

Contao: Remember-me tokens will not be cleared after a password change
When a front end member changes their password, the corresponding remember-me tokens are not removed.

Contao: Cross site scripting in the file manager
Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the backend.

Contao: Unencoded insert tags in the frontend
It is possible to inject insert tags via the form generator if the submitted form data is output on the page in a specific way.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.

Contao affected by directory traversal in the file selector widget
Back end users can list files outside their file mounts or the document root in the FileSelector widget.