Already a customer?
Log in now
You would like to become a customer?
Test trakked now
Twelve vulnerabilities have been fixed. Three of them are rated critical with 9.0 to 9.8 out of 10: they affect passkey login on websites with a frontend member login, the backend file manager and the {{figure}} insert tag. We recommend updating as soon as possible.
Security vulnerabilities closed:
- Stored cross-site scripting in the file manager via crafted filenames (GHSA-xh3r-77ch-frm3)
- NoPrivateNetworkExceptRootPagesHttpClient does not pin the checked IP of cached hosts (GHSA-wvj5-rchg-986m)
- Insert tag injection in the breadcrumb module on 404 pages (GHSA-6m74-9w88-r3fh)
- Session invalidation upon enabling or disabling 2FA (GHSA-5mg3-mv6j-57wc)
- Cross-site scripting in the figure insert tag (GHSA-pc2r-hvrc-f4v6)
- Insufficient CSRF protection for backend login (GHSA-rgq4-cg48-xjxj)
- Insufficient scope validation for passkey authentication (GHSA-5mw8-wv8h-h6hx)
- Contao crawler leaks confidential headers (GHSA-26h3-f97j-vj85)
- Filemount access-control bypass in DC_Folder::editAll (GHSA-9jfh-v443-w3fj)
- Path traversal via decode-after-check in the image insert tag (GHSA-r7cf-mfp4-r23h)
- Server-side request forgery via unvalidated RSS feed URLs in the legacy module (GHSA-4mx5-xq7q-77cm)
- HTML sanitizer is vulnerable to DOM clobbering (GHSA-58r4-2p86-jp4x)
Details of the security vulnerabilities
The full post is only visible for trakked customers
About Contao 6.0
The first stable version of Contao 6.0 has been released on 26 August 2026 and will be the successor to Contao 5.7. 6.0 will be updated until 14 February 2027, after which it will be replaced by Contao 6.1.
