Search for vulnerabilities
| Vulnerability ID | VCID-7nh2-bb7m-3udz |
| Aliases |
GHSA-wq43-8r5p-w3mc
|
| Summary | contao/core PHP object injection vulnerability allows for arbitrary code execution PHP object injection vulnerability was identified in contao/core due to untrusted data being passed to `deserialize()` function. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 8.0 |
| Risk | 4.0 |
| Affected and Fixed Packages | Package Details |
| System | Score | Found at |
|---|---|---|
| generic_textual | HIGH | https://contao.org/en/news/major-security-hole-found-in-contao.html |
| cvssv3.1_qr | HIGH | https://github.com/advisories/GHSA-wq43-8r5p-w3mc |
| generic_textual | HIGH | https://github.com/contao/core/commit/d67c46c1f1283134e3050244cfdda0ef26fa5cd4 |
| generic_textual | HIGH | https://github.com/contao/core/commit/f939b5be8a0048ef779def3289e2072febef1b37 |
| generic_textual | HIGH | https://github.com/contao/core/issues/6695 |
| generic_textual | HIGH | https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/2014-02-13.yaml |
No EPSS data available for this vulnerability.
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-06-04T16:21:42.471710+00:00 | GitLab Importer | Import | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/contao/core/GHSA-wq43-8r5p-w3mc.yml | 38.6.0 |