CVE-2022-24899
Cross site scripting via canonical tag
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross site scripting via canonical tag
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
- Record
CVE-2022-24899- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-4528
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
- Record
EUVD-2022-4528- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m8x6-6r63-qvj2
Cross site scripting via canonical tag in Contao
Impact
Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end).
Patches
Update to Contao 4.13.3.
Workarounds
Disable canonical tags in the root page settings.
References
https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
- Record
GHSA-m8x6-6r63-qvj2- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
- Record
CVE-2022-24899- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross site scripting via canonical tag
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
- Record
CVE-2022-24899- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-m8x6-6r63-qvj2
Cross site scripting via canonical tag in Contao
Impact
Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end).
Patches
Update to Contao 4.13.3.
Workarounds
Disable canonical tags in the root page settings.
References
https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
- Record
GHSA-m8x6-6r63-qvj2- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
contao/core-bundlePackagist |
4.13.0 up to 4.13.3 | 4.13.3 |
contao/contaoPackagist |
4.13.0 up to 4.13.3 | 4.13.3 |
contao/core-bundlePackagist |
4.13.0 up to 4.13.3, plus listed versions 4.13.14.13.2 |
4.13.3 |
contao/contaoPackagist |
4.13.0 up to 4.13.3, plus listed versions 4.13.14.13.2 |
4.13.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Contao <4.13.3 - Cross-Site Scripting |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24899 is a high vulnerability (CVSS 7.2) in Contao, published May 5, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.48%, the 91st percentile. Fixed in contao/core-bundle 4.13.3.
References
github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c
contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
nvd.nist.gov/vuln/detail/CVE-2022-24899