These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A low-privileged backend user in Contao, an Open Source CMS, can read, create, update, or delete records in tables outside assigned module permissions due to improper access control in the table access voter. This issue is fixed in version 5.7.12. The vulnerability allows unauthorized data access, and defenders should prioritize patching to prevent exploitation. The issue arises from the TableAccessVoter: [truncated]
A Cross-site scripting vulnerability exists in Contao's comments bundle from version 4.0.0 until 5.3.50 and 5.7.12. An unauthenticated visitor can submit a comment with malicious email or website metadata that can execute script in the Contao backend origin under a backend user's session when they open the Comments module. The vulnerability allows attackers to inject malicious scripts, potentially leading [truncated]
CVE-2026-107844 is a path traversal vulnerability in Contao's images controller. The vulnerability allows an unauthenticated request to return files under the project directory through BinaryFileResponse when their names use an extension allowed by contao.image.valid_extensions. The route can also reveal whether arbitrary paths exist, and debug responses can disclose absolute filesystem paths, but paths b [truncated]
The Contao Feed Reader front-end module is vulnerable to SSRF attacks due to a lack of scheme or private-address validation. A backend user with module-edit permissions can make the server request internal network services, loopback addresses, or cloud metadata endpoints. This issue affects Contao versions from 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8. The vulnerability is fixed in Contao ve [truncated]