Already a customer?
Log in now
You would like to become a customer?
Test trakked now
This security release addresses a total of nine (!) vulnerabilities: one of which is classified as critical according to its respective CVSS score. All vulnerabilities are assigned a CVE number or GHSA number and are reported to the relevant security databases so that automated tools such as trakked can detect affected installations.
Security vulnerabilities closed:
- Exposure of sensitive information through a stale search index (GHSA-x2rp-9qf7-2fmq)
- Unrestricted activation email resending (GHSA-mfxh-vp55-7gc6)
- Cross-site request forgery in custom backend actions (GHSA-9ff2-p842-45wq)
- Path traversal in the images controller (GHSA-mrvp-7wmx-5m4h)
- Cross-site scripting in the comments bundle (GHSA-628f-v4f6-p37r)
- Cross-site scripting in the frontend search results (GHSA-h57j-5f5m-789v)
- Non-admin users can self-grant permissions that implicitly make them administrators (GHSA-r9qp-pqx5-8369)
- Improper access control in the CSV import wizard (GHSA-23w9-4pg3-xwm3)
- Improper access control in the newsletter module (GHSA-3r9g-pfhv-3228)
Vulnerability details
The full post is only visible for trakked customers
About Contao 5.3 LTS
The first stable version of Contao 5.3 has been released on February 16, 2024, replacing Contao 4.13 as the long term support version. As an LTS version, 5.3 will be provided with bug fixes until February 14, 2027 and security-related updates until February 14, 2028. Contao 5.7 is the next LTS version of Contao and was released in February 2026, ensuring a smooth transition.
