Most recent entries from all

EUVD-2026-186125

fkie_cve-2024-45604

Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

GHSA-4p75-5p53-65m9 — Contao affected by directory traversal in the file selector widget

Affected: Packagist: contao/core-bundle

### Impact

Back end users can list files outside their file mounts or the document root in the FileSelector widget.

### Patches

Update to Contao 4.13.49.

### Workarounds

None.

### References

https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

### Credits

Thanks to Jakob Steeg from usd AG for reporting this vulnerability.

WID-SEC-W-2024-2152 — Contao: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.