Repository navigation
Security: contao/contao
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Exposure of sensitive information through a stale search indexGHSA-x2rp-9qf7-2fmq published
Aug 25, 2026 by leofeyerModerate -
Unrestricted activation email resendingGHSA-mfxh-vp55-7gc6 published
Aug 25, 2026 by leofeyerModerate -
Cross-site request forgery in custom backend actionsGHSA-9ff2-p842-45wq published
Aug 25, 2026 by leofeyerLow -
Path traversal in the images controllerGHSA-mrvp-7wmx-5m4h published
Aug 25, 2026 by leofeyerModerate -
Cross-site scripting in the comments bundleGHSA-628f-v4f6-p37r published
Aug 25, 2026 by leofeyerCritical -
Improper access control in the preview links moduleGHSA-q6wp-fr43-gm9v published
Aug 25, 2026 by leofeyerModerate -
Cross-site scripting in the frontend search resultsGHSA-h57j-5f5m-789v published
Aug 25, 2026 by leofeyerModerate -
Non-admin users can self-grant permissions that implicitly make them administratorsGHSA-r9qp-pqx5-8369 published
Aug 25, 2026 by leofeyerHigh -
Improper access control in the CSV import wizardGHSA-23w9-4pg3-xwm3 published
Aug 25, 2026 by leofeyerModerate -
Improper access control in the newsletter moduleGHSA-3r9g-pfhv-3228 published
Aug 25, 2026 by leofeyerModerate