Already a customer?
Log in now
You would like to become a customer?
Test trakked now
For all three currently supported Contao versions, Contao 4.13.49, 5.3.15 and 5.4.3 fix two security vulnerabilities. One was reported by Jakob Steeg from usd AG and the other was discovered by Andreas Schempp from the core team. The Contao core team has categorised the potential damage of one of the two vulnerabilities as «high». A quick update is therefore essential in any case, there are no workarounds.
- Remote command execution through file upload (CVE-2024-45398)
- Insert tag injection via canonical URL (CVE-2024-45612)
Vulnerability details
The full post is only visible for trakked customers
About Contao 5.4
The first stable version of Contao 5.4 has been released on 15 August 2024 and was the successor of Contao 5.3. 5.4 has been updated until 14 February 2025, after which it will be replaced by Contao 5.5.
