https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T20:12:01.667895+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-186125 EUVD-2026-186125 2026-10-06T20:12:01.672262+00:00 EUVD-2026-186125 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45604 fkie_cve-2024-45604 2026-10-06T20:12:01.672315+00:00

Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-4p75-5p53-65m9 GHSA-4p75-5p53-65m9 — Contao affected by directory traversal in the file selector widget 2026-10-06T20:12:01.672363+00:00

Affected: Packagist: contao/core-bundle

### Impact

Back end users can list files outside their file mounts or the document root in the FileSelector widget.

### Patches

Update to Contao 4.13.49.

### Workarounds

None.

### References

https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

### Credits

Thanks to Jakob Steeg from usd AG for reporting this vulnerability.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2152 WID-SEC-W-2024-2152 — Contao: Mehrere Schwachstellen 2026-10-06T20:12:01.672424+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.