CVE-2017-16558
Contao SQL injection in the backend and listing module
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
- Record
CVE-2017-16558- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
- Record
CVE-2017-16558- Updated
- 2026-11-02
EUVDEUVD-2022-5472 No score
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
- Record
EUVD-2022-5472- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w38g-hj45-mjjp
Contao SQL injection in the backend and listing module
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module.
- Record
GHSA-w38g-hj45-mjjp- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
- Record
CVE-2017-16558- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-w38g-hj45-mjjp
Contao SQL injection in the backend and listing module
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module.
- Record
GHSA-w38g-hj45-mjjp- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
contao/contaoPackagist |
3.0.0 to 3.5.30 | None known |
contao/contaoPackagist |
4.0.0 up to 4.4.8 | 4.4.8 |
contao/core-bundlePackagist |
4.0.0 up to 4.4.8 | 4.4.8 |
contao/listing-bundlePackagist |
4.0.0 up to 4.4.8 | 4.4.8 |
contao/core-bundlePackagist |
3.0.0 to 3.5.30 | None known |
contao/listing-bundlePackagist |
3.0.0 to 3.5.30 | None known |
contao/core-bundlePackagist |
4.0.0 up to 4.4.8, plus listed versions 4.0.14.0.24.0.34.0.44.1.0 Show 37 moreShow less4.1.0-RC14.1.0-beta14.1.14.1.24.1.34.2.04.2.0-RC14.2.0-beta14.2.14.2.24.2.34.2.44.2.54.3.04.3.0-RC14.3.14.3.104.3.114.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.94.4.04.4.0-RC14.4.0-RC24.4.0-beta14.4.14.4.24.4.34.4.44.4.54.4.64.4.7 |
4.4.8 |
contao/listing-bundlePackagist |
4.0.0 up to 4.4.8, plus listed versions 4.0.14.0.24.1.04.1.0-RC14.1.0-beta1 Show 31 moreShow less4.1.14.1.24.1.34.2.04.2.0-RC14.2.0-beta14.2.14.2.24.3.04.3.14.3.104.3.114.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.94.4.04.4.0-RC14.4.0-RC24.4.0-beta14.4.14.4.24.4.34.4.44.4.54.4.64.4.7 |
4.4.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16558 is a critical vulnerability (CVSS 9.8) in Contao Cms, published April 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in contao/contao 4.4.8.
References
contao.org/de/changelog/versions/4.4.html
nvd.nist.gov/vuln/detail/CVE-2017-16558
github.com/contao/contao/commit/501cb3cd34d61089b94e7ed78da53977bc71fc3e