Most recent entries from all

EUVD-2026-186145

fkie_cve-2024-45612

Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.

GHSA-2xpq-xp6c-5mgj — Contao affected by insert tag injection via canonical URL

Affected: Packagist: contao/core-bundle

### Impact

It is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered.

### Patches

Update to Contao 4.13.49, 5.3.15 or 5.4.3.

### Workarounds

Disable canonical tags in the settings of the website root page.

### References

https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

WID-SEC-W-2024-2152 — Contao: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.