Already a customer?
Log in now
You would like to become a customer?
Test trakked now
This security release fixes eleven vulnerabilities. Two of them are rated critical with a score of 9.0 out of 10 each and concern cross-site scripting in the file manager and the {{figure}} insert tag. Updating promptly is recommended.
Security vulnerabilities closed:
- Stored cross-site scripting in the file manager via crafted filenames (GHSA-xh3r-77ch-frm3)
- NoPrivateNetworkExceptRootPagesHttpClient does not pin the checked IP of cached hosts (GHSA-wvj5-rchg-986m)
- Insert tag injection in the breadcrumb module on 404 pages (GHSA-6m74-9w88-r3fh)
- Session invalidation upon enabling or disabling 2FA (GHSA-5mg3-mv6j-57wc)
- Cross-site scripting in the figure insert tag (GHSA-pc2r-hvrc-f4v6)
- Insufficient CSRF protection for backend login (GHSA-rgq4-cg48-xjxj)
- Contao crawler leaks confidential headers (GHSA-26h3-f97j-vj85)
- Filemount access-control bypass in DC_Folder::editAll (GHSA-9jfh-v443-w3fj)
- Path traversal via decode-after-check in the image insert tag (GHSA-r7cf-mfp4-r23h)
- Server-side request forgery via unvalidated RSS feed URLs in the legacy module (GHSA-4mx5-xq7q-77cm)
- HTML sanitizer is vulnerable to DOM clobbering (GHSA-58r4-2p86-jp4x)
Details of the security vulnerabilities
The full post is only visible for trakked customers
About Contao 5.3 LTS
The first stable version of Contao 5.3 has been released on February 16, 2024, replacing Contao 4.13 as the long term support version. As an LTS version, 5.3 will be provided with bug fixes until February 14, 2027 and security-related updates until February 14, 2028. Contao 5.7 is the next LTS version of Contao and was released in February 2026, ensuring a smooth transition.
