contao has 9 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 7. The median CVSS is 4.3 (medium), with 1 rated critical. None have a confirmed exploitation report. Most affected products: contao/core-bundle (6), contao/contao (2), contao/comments-bundle (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.3
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Products
- contao/core-bundle 6
- contao/contao 2
- contao/comments-bundle 1
Worst active — by depth score
contao vulnerabilities
CVEs affecting contao, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-107851Medium· 4.3Contao is an Open Source CMS
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the…
CVE-2026-107850Medium· 4.3Contao is an Open Source CMS
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is Preview…
CVE-2026-107848Low· 3.5Contao is an Open Source CMS
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions di…
CVE-2026-107845Critical· 9.3Contao is an Open Source CMS
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comm…
CVE-2026-107844Medium· 5.3Contao is an Open Source CMS
Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBasePath() to verif…
CVE-2026-107843Medium· 5.3Contao is an Open Source CMS
Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or th…
CVE-2026-107842Medium· 5.3Contao is an Open Source CMS
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from …
CVE-2026-57232Low· 3.1Contao is an Open Source CMS
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or priv…
CVE-2026-55824Low· 2.6Contao is an Open Source CMS
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to ext…