Already a customer?
Log in now
You would like to become a customer?
Test trakked now
In addition to addressing a security vulnerability, It also restores compatibility with ICU 78 and corrects sorting behavior to ensure that only records from the same parent table are considered.
Security vulnerability closed:
- Server-side request forgery (SSRF) via unvalidated RSS feed URLs (CVE-2026-57232)
Changelog of the fixed issues in Contao 5.3.48:
- #10004 Resolve insert tags in the accordion header ( dennisbohn )
-
#9996
Only consider items from the same
ptablefor sorting ( lukasbableck ) - #9926 Fix compatibility with ICU version 78 ( ausi )
-
#9920
Handle invalid database values in the
InputUnitwidget ( aschempp ) -
#9940
Remove the obsolete
Input::setGet()from the event list ( ausi ) - #9915 Handle file errors in the Twig filesystem loader ( aschempp )
-
#9927
Delete
OptIntokens if the model does not exist anymore ( fritzmg ) -
#9911
Complete the contao 2FA provider on the
code_validevent ( zoglo )
Details of the security vulnerability
The full post is only visible for trakked customers
About Contao 5.3 LTS
The first stable version of Contao 5.3 has been released on February 16, 2024, replacing Contao 4.13 as the long term support version. As an LTS version, 5.3 will be provided with bug fixes until February 14, 2027 and security-related updates until February 14, 2028. Contao 5.7 is the next LTS version of Contao and was released in February 2026, ensuring a smooth transition.
