Already a customer?
Log in now
You would like to become a customer?
Test trakked now
For all three currently supported Contao versions, Contao 4.13.49, 5.3.15 and 5.4.3 fix two security vulnerabilities. One was reported by Jakob Steeg from usd AG and the other was discovered by Andreas Schempp from the core team. The Contao core team has categorised the potential damage of one of the two vulnerabilities as «high». A quick update is therefore essential in any case, there are no workarounds.
Contao 4.13.49 also fixes a third vulnerability, which was also reported by Jakob Steeg from usd AG.
- Directory traversal in the file selector widget (CVE-2024-45604)
- Remote command execution through file upload (CVE-2024-45398)
- Insert tag injection via canonical URL (CVE-2024-45612)
Vulnerability details
The full post is only visible for trakked customers
About Contao 4.13 LTS
The first stable version of Contao 4.13 has been released on February 17, 2022, replacing Contao 4.9 as the long term support version. As an LTS version, 4.13 will be provided with bug fixes until February 14, 2025 and security-related updates until February 14, 2026. Contao 5.3 will be the next LTS version of Contao and has been released in February 2024, ensuring a stress-free transition.
