CVE-2019-11512
Contao SQL injection in the file manager
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.
- Record
CVE-2019-11512- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.
- Record
CVE-2019-11512- Updated
- 2026-11-02
EUVDEUVD-2022-5401 No score
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.
- Record
EUVD-2022-5401- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vq59-x6mq-4wgw
Contao SQL injection in the file manager
David Wind, penetration tester with A1 Digital, has discovered that the SQL injection vulnerability originally published under CVE-2017-16558 can still be exploited in the file manager in Contao 4.
- Record
GHSA-vq59-x6mq-4wgw- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.
- Record
CVE-2019-11512- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-vq59-x6mq-4wgw
Contao SQL injection in the file manager
David Wind, penetration tester with A1 Digital, has discovered that the SQL injection vulnerability originally published under CVE-2017-16558 can still be exploited in the file manager in Contao 4.
- Record
GHSA-vq59-x6mq-4wgw- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
contao/contaoPackagist |
4.1.0 up to 4.4.39 | 4.4.39 |
contao/contaoPackagist |
4.5.0 up to 4.7.5 | 4.7.5 |
contao/core-bundlePackagist |
4.1.0 up to 4.4.39 | 4.4.39 |
contao/core-bundlePackagist |
4.5.0 up to 4.7.5 | 4.7.5 |
contao/contaoPackagist |
4.1.0 up to 4.4.39, plus listed versions 4.4.224.4.234.4.244.4.254.4.26 Show 12 moreShow less4.4.274.4.284.4.294.4.304.4.314.4.324.4.334.4.344.4.354.4.364.4.374.4.38 |
4.4.39 |
contao/contaoPackagist |
4.5.0 up to 4.7.5, plus listed versions 4.5.134.5.144.6.04.6.14.6.10 Show 21 moreShow less4.6.114.6.124.6.134.6.144.6.24.6.34.6.44.6.54.6.64.6.74.6.84.6.94.7.04.7.0-RC14.7.0-RC24.7.0-RC34.7.0-RC44.7.14.7.24.7.34.7.4 |
4.7.5 |
contao/core-bundlePackagist |
4.1.0 up to 4.4.39, plus listed versions 4.1.14.1.24.1.34.2.04.2.0-RC1 Show 45 moreShow less4.2.0-beta14.2.14.2.24.2.34.2.44.2.54.3.04.3.0-RC14.3.14.3.104.3.114.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.94.4.04.4.0-RC14.4.0-RC24.4.0-beta14.4.14.4.104.4.114.4.124.4.134.4.144.4.154.4.164.4.174.4.184.4.194.4.24.4.204.4.214.4.224.4.234.4.244.4.254.4.264.4.274.4.284.4.29 |
4.4.39 |
contao/core-bundlePackagist |
4.5.0 up to 4.7.5, plus listed versions 4.5.14.5.104.5.114.5.124.5.13 Show 36 moreShow less4.5.144.5.24.5.34.5.44.5.54.5.64.5.74.5.84.5.94.6.04.6.0-RC14.6.0-RC24.6.0-RC34.6.14.6.104.6.114.6.124.6.134.6.144.6.24.6.34.6.44.6.54.6.64.6.74.6.84.6.94.7.04.7.0-RC14.7.0-RC24.7.0-RC34.7.0-RC44.7.14.7.24.7.34.7.4 |
4.7.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11512 is a critical vulnerability (CVSS 9.8) in Contao, published July 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.46%, the 73rd percentile. Fixed in contao/contao 4.4.39.
References
contao.org/en/news/security-vulnerability-cve-2019-11512.html
nvd.nist.gov/vuln/detail/CVE-2019-11512
github.com/contao/contao/commit/87d92f823b08b91a0aeb522284537c8afcdb8aba
Left out here: 16 versions. The JSON record has them.