CVE-2024-28190
Contao core bundle vulnerable to cross site scripting in the file manager
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Contao core bundle vulnerable to cross site scripting in the file manager
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
- Record
CVE-2024-28190- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-1304
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
- Record
EUVD-2024-1304- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v24p-7p4j-qvvf
Contao: Cross site scripting in the file manager
Impact
Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the backend.
Patches
Update to Contao 4.13.40 or Contao 5.3.4.
Workarounds
Disable uploads for untrusted users.
References
https://contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Credits
Thanks to Alexander Wuttke for reporting this vulnerability.
- Record
GHSA-v24p-7p4j-qvvf- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
- Record
CVE-2024-28190- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Contao core bundle vulnerable to cross site scripting in the file manager
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
- Record
CVE-2024-28190- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-v24p-7p4j-qvvf
Contao: Cross site scripting in the file manager
Impact
Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the backend.
Patches
Update to Contao 4.13.40 or Contao 5.3.4.
Workarounds
Disable uploads for untrusted users.
References
https://contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Credits
Thanks to Alexander Wuttke for reporting this vulnerability.
- Record
GHSA-v24p-7p4j-qvvf- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
contao/core-bundlePackagist |
4.0.0 up to 4.13.40 | 4.13.40 |
contao/core-bundlePackagist |
5.0.0-RC1 up to 5.3.4 | 5.3.4 |
contao/core-bundlePackagist |
4.0.0 up to 4.13.40, plus listed versions 4.0.14.0.24.0.34.0.44.1.0 Show 45 moreShow less4.1.0-RC14.1.0-beta14.1.14.1.24.1.34.10.04.10.0-RC14.10.0-RC24.10.0-RC34.10.0-RC44.10.14.10.24.10.34.10.44.10.54.10.64.10.74.11.04.11.0-RC14.11.0-RC24.11.14.11.24.11.34.11.44.11.54.11.64.11.74.11.84.11.94.12.04.12.0-RC14.12.0-RC24.12.0-RC34.12.14.12.24.12.34.12.44.12.54.12.64.12.74.13.04.13.0-RC14.13.0-RC24.13.0-RC34.13.1 |
4.13.40 |
contao/core-bundlePackagist |
5.0.0-RC1 up to 5.3.4, plus listed versions 5.0.05.0.0-RC25.0.0-RC35.0.0-RC45.0.1 Show 45 moreShow less5.0.105.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.95.1.05.1.0-RC15.1.0-RC25.1.0-RC35.1.15.1.105.1.115.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-RC15.2.0-RC25.2.0-RC35.2.0-RC45.2.0-RC55.2.0-RC65.2.15.2.105.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.95.3.05.3.0-RC15.3.0-RC25.3.0-RC3 |
5.3.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-28190 is a medium vulnerability (CVSS 5.4) in Contao, published April 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in contao/core-bundle 4.13.40.
References
github.com/contao/contao/security/advisories/GHSA-v24p-7p4j-qvvf
contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager
nvd.nist.gov/vuln/detail/CVE-2024-28190
Left out here: 230 versions. The JSON record has them.