We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
If BBCode is enabled for comments, users can inject CSS styles.
Update to Contao 4.13.40 or 5.3.4.
Disable BBCode for comments.
https://contao.org/en/security-advisories/insufficient-bbcode-sanitization
If you have any questions or comments about this advisory, open an issue in contao/contao.
Impact
If BBCode is enabled for comments, users can inject CSS styles.
Patches
Update to Contao 4.13.40 or 5.3.4.
Workarounds
Disable BBCode for comments.
References
https://contao.org/en/security-advisories/insufficient-bbcode-sanitization
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.