https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T14:50:49.519758+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-223401 EUVD-2026-223401 2026-10-06T14:50:49.524592+00:00 EUVD-2026-223401 https://cve.radiocsirt.org/vuln/fkie_cve-2025-29790 fkie_cve-2025-29790 2026-10-06T14:50:49.524633+00:00

Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.

 https://cve.radiocsirt.org/vuln/ghsa-vqqr-fgmh-f626 GHSA-vqqr-fgmh-f626 — Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads 2026-10-06T14:50:49.524676+00:00

Affected: Packagist: contao/core-bundle

### Impact

Users can upload SVG files with malicious code, which is then executed in the back end and/or front end.

### Patches

Update to Contao 4.13.54, 5.3.30 or 5.5.6.

### Workarounds

Remove `svg,svgz` from the allowed upload file types in the system settings and from `contao.editable_files` in the `config.yaml`.

### References

https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0576 WID-SEC-W-2025-0576 — Contao: Schwachstelle ermöglicht Cross-Site Scripting 2026-10-06T14:50:49.524731+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Contao ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.