Already a customer?
Log in now
You would like to become a customer?
Test trakked now
The security releases Contao 4.4.56, 4.9.18 and 4.11.7 fix three vulnerabilities at once (CVE-2021-35955, CVE-2021-37627 and CVE-2021-37626). One of them was reported from outside, the other two were found by core developer Martin Auswöger. Martin himself developed the patches for all three vulnerabilities and all three target versions. An extremely time-consuming and non-trivial work. Many thanks to you, dear Martin! By the way: He owns a GitHub Sponsors profile for all readers who want to acknowledge his work.
- Prevent privilege escalation with the form generator (CVE-2021-37627)
- Prevent PHP file inclusion via insert tags (CVE-2021-37626)
- Prevent XSS via HTML attributes in the back end (CVE-2021-35955)
Vulnerability details
The full post is only visible for trakked customers
About Contao 4.11
The first stable version of Contao 4.11 has been released on 17 February 2021 and was the successor of Contao 4.10. 4.11 has been prvoided with updates until 14 August 2021, after which it was replaced by Contao 4.12.
Add a comment