GHSA-wxxw-5gq6-j2g5
contao/core Insufficient input validation allows for code injection and remote execution
GHSA-wxxw-5gq6-j2g5 is a critical vulnerability (CVSS 9.0) in contao/core, published May 15, 2024. No source lists public exploit code. Fixed in contao/core 2.11.17.
- Severity
- 9.0 CriticalCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.11.17contao/core +3 more
Description
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire Contao installation will no longer be accessible or malicious code can be executed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
contao/corePackagist | 2.0.0 up to 2.11.17 | 2.11.17 |
contao/corePackagist | 3.0.0 up to 3.2.9 | 3.2.9 |
contao/corePackagist | 2.0.0 up to 2.11.17, plus listed versions 2.10.02.10.12.10.22.10.32.10.4 Show 45 moreShow less2.10.RC12.10.beta12.11.02.11.12.11.102.11.112.11.122.11.132.11.142.11.152.11.162.11.22.11.32.11.42.11.52.11.62.11.72.11.82.11.92.11.RC12.11.RC22.6.02.6.12.6.22.6.32.6.42.6.52.6.62.6.72.6.82.7.02.7.12.7.22.7.32.7.42.7.52.7.62.7.72.8.02.8.12.8.22.8.32.8.42.8.RC12.8.RC2 | 2.11.17 |
contao/corePackagist | 3.0.0 up to 3.2.9, plus listed versions 3.0.13.0.23.0.33.0.43.0.5 Show 21 moreShow less3.0.63.1.03.1.13.1.23.1.33.1.43.1.53.1.RC13.1.beta13.2.03.2.13.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.RC13.2.beta13.2.beta2 | 3.2.9 |
What each source reports
GitHub Advisories Score used
contao/core Insufficient input validation allows for code injection and remote execution
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire Contao installation will no longer be accessible or malicious code can be executed.
- Record
GHSA-wxxw-5gq6-j2g5- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
contao/core Insufficient input validation allows for code injection and remote execution
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire Contao installation will no longer be accessible or malicious code can be executed.
- Record
GHSA-wxxw-5gq6-j2g5- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/contao/core/issues/6855
c-c-a.org/aktuelles/news/details/eine-neue-kritische-sicherheitsluecke-in-contao-entdeckt
web.archive.org/web/20240214121817/https://contao.org/en/news/new-security-hole-found-in-contao
Left out here: 7 versions. The JSON record has them.