CVE-2023-36806
Contao cross site scripting vulnerability via input unit widget
Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Contao cross site scripting vulnerability via input unit widget
Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.
- Record
CVE-2023-36806- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-1951
Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.
- Record
EUVD-2023-1951- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4gpr-p634-922x
Cross site scripting via input unit widget
Impact
Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview (back end) and on the website (front end).
Patches
Update to Contao 4.9.42, 4.13.28 or 5.1.10.
Workarounds
Disable login for all untrusted back end users.
References
https://contao.org/en/security-advisories/cross-site-scripting-in-widgets-with-units
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Credits
Thanks to Christian Pöschl and Fabian Brenner from usd AG for reporting this vulnerability.
- Record
GHSA-4gpr-p634-922x- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.
- Record
CVE-2023-36806- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Contao cross site scripting vulnerability via input unit widget
Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.
- Record
CVE-2023-36806- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-4gpr-p634-922x
Cross site scripting via input unit widget
Impact
Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview (back end) and on the website (front end).
Patches
Update to Contao 4.9.42, 4.13.28 or 5.1.10.
Workarounds
Disable login for all untrusted back end users.
References
https://contao.org/en/security-advisories/cross-site-scripting-in-widgets-with-units
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Credits
Thanks to Christian Pöschl and Fabian Brenner from usd AG for reporting this vulnerability.
- Record
GHSA-4gpr-p634-922x- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
contao/core-bundlePackagist |
4.0.0 up to 4.9.42 | 4.9.42 |
contao/core-bundlePackagist |
4.10.0 up to 4.13.28 | 4.13.28 |
contao/core-bundlePackagist |
5.0.0 up to 5.1.10 | 5.1.10 |
contao/core-bundlePackagist |
4.0.0 up to 4.9.42, plus listed versions 4.0.14.0.24.0.34.0.44.1.0 Show 45 moreShow less4.1.0-RC14.1.0-beta14.1.14.1.24.1.34.2.04.2.0-RC14.2.0-beta14.2.14.2.24.2.34.2.44.2.54.3.04.3.0-RC14.3.14.3.104.3.114.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.94.4.04.4.0-RC14.4.0-RC24.4.0-beta14.4.14.4.104.4.114.4.124.4.134.4.144.4.154.4.164.4.174.4.184.4.194.4.24.4.204.4.214.4.22 |
4.9.42 |
contao/core-bundlePackagist |
4.10.0 up to 4.13.28, plus listed versions 4.10.14.10.24.10.34.10.44.10.5 Show 45 moreShow less4.10.64.10.74.11.04.11.0-RC14.11.0-RC24.11.14.11.24.11.34.11.44.11.54.11.64.11.74.11.84.11.94.12.04.12.0-RC14.12.0-RC24.12.0-RC34.12.14.12.24.12.34.12.44.12.54.12.64.12.74.13.04.13.0-RC14.13.0-RC24.13.0-RC34.13.14.13.104.13.114.13.124.13.134.13.144.13.154.13.164.13.174.13.184.13.194.13.24.13.204.13.214.13.224.13.23 |
4.13.28 |
contao/core-bundlePackagist |
5.0.0 up to 5.1.10, plus listed versions 5.0.15.0.105.0.25.0.35.0.4 Show 18 moreShow less5.0.55.0.65.0.75.0.85.0.95.1.05.1.0-RC15.1.0-RC25.1.0-RC35.1.15.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.9 |
5.1.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36806 is a medium vulnerability (CVSS 6.5) in Contao, published July 25, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in contao/core-bundle 4.9.42.
References
github.com/contao/contao/security/advisories/GHSA-4gpr-p634-922x
herolab.usd.de/security-advisories/usd-2023-0020
nvd.nist.gov/vuln/detail/CVE-2023-36806
Left out here: 158 versions. The JSON record has them.