Security Digest · Critical advisory (no CVE assigned)
GHSA-wxxw-5gq6-j2g5: contao/core Insufficient input validation allows for code injection and remote execution
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation.
CVSS 9.0 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | contao/core | >= 2.0.0, < 2.11.17 | 2.11.17 |
| Composer (PHP) | contao/core | >= 3.0.0, < 3.2.9 | 3.2.9 |
Details
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire Contao installation will no longer be accessible or malicious code can be executed.
CVSS: 9.0 (v3.1) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-wxxw-5gq6-j2g5 github.com
- github.com github.com
- github.com github.com
- github.com github.com
- c-c-a.org c-c-a.org
- github.com github.com
- web.archive.org web.archive.org
Critical Composer (PHP) advisories · Today’s Security Digest