https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:27:43.527838+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-251198 EUVD-2026-251198 2026-10-06T16:27:43.576767+00:00 EUVD-2026-251198 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45965 fkie_cve-2024-45965 2026-10-06T16:27:43.576851+00:00

Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.

 https://cve.radiocsirt.org/vuln/ghsa-mrw8-5368-phm3 Withdrawn: GHSA-mrw8-5368-phm3 — Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript 2026-10-06T16:27:43.576900+00:00

Withdrawn by the publisher.

Affected: Packagist: contao/contao

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vqqr-fgmh-f626. This link is maintained to preserve external references.

## Original Description

Contao 5.4.1 allows an authenticated admin account to upload a SVG file containing malicious javascript code into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted javascript to the target.