{"id":"CVE-2017-10993","aliases":["EUVD-2022-5717","GHSA-x5g4-crxq-qxjx"],"status":"published","title":"Contao Core directory traversal vulnerability","description":"Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02722,"percentile":0.86141,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2017-07-21T06:00:00Z","modified":"2026-10-24T10:30:36Z","fixes":[{"ecosystem":"Packagist","package":"contao/contao","fixed_in":["4.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"contao/core-bundle","fixed_in":["4.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"contao/core","fixed_in":["3.5.28"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"contao/contao","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.4.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"contao/core-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.4.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"contao/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.5.28"}]}]},{"source":"osv","ecosystem":"Packagist","package":"contao/contao","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.4.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"contao/core-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.4.1"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.1.0","4.1.0-RC1","4.1.0-beta1","4.1.1","4.1.2","4.1.3","4.2.0","4.2.0-RC1","4.2.0-beta1","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.3.0","4.3.0-RC1","4.3.1","4.3.10","4.3.11","4.3.2","4.3.3","4.3.4","4.3.5","4.3.6","4.3.7","4.3.8","4.3.9","4.4.0","4.4.0-RC1","4.4.0-RC2","4.4.0-beta1"]},{"source":"osv","ecosystem":"Packagist","package":"contao/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.5.28"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.RC1","3.1.beta1","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.15","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.20","3.2.21","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.2.RC1","3.2.beta1","3.2.beta2","3.3.0","3.3.0-RC1","3.3.0-RC2","3.3.0-beta1","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.4.0","3.4.0-RC1","3.4.0-beta1","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.5.0","3.5.0-RC1","3.5.0-beta1","3.5.1","3.5.10","3.5.11","3.5.12","3.5.13","3.5.14","3.5.15","3.5.16","3.5.17","3.5.18","3.5.19","3.5.2","3.5.20","3.5.21","3.5.22","3.5.23","3.5.24","3.5.25","3.5.26","3.5.27","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9"]}],"products":[{"vendor":"contao","product":"contao_cms"}],"references":[{"url":"https://contao.org/en/news/contao-3_5_28.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10993","tags":["advisory"]},{"url":"https://contao.org/en/news/contao-4_4_1.html","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2017-10993.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2017-10993.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2017-10993.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x5g4-crxq-qxjx"}],"sources":{"cve":[{"id":"CVE-2017-10993","description":"Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.","status":"published","published":"2017-07-21T06:00:00Z","modified":"2024-08-05T17:57:57.413Z","updated_at":"2026-11-02T14:33:13.27226Z"}],"euvd":[{"id":"EUVD-2022-5717","description":"Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.","status":"published","published":"2017-07-21T06:00:00Z","modified":"2024-08-05T17:57:57Z","updated_at":"2026-11-03T02:23:24.743229Z"}],"ghsa":[{"id":"GHSA-x5g4-crxq-qxjx","title":"Contao Core directory traversal vulnerability","description":"A logged in back end user can include arbitrary PHP files by manipulating an URL parameter. Since Contao does not allow to upload PHP files in the file manager, the attack is limited to the existing PHP files on the server.","status":"published","published":"2022-05-13T01:42:03Z","modified":"2024-04-25T23:17:02Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:47.338362Z"}],"nvd":[{"id":"CVE-2017-10993","description":"Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.","status":"published","published":"2017-07-21T06:29:00.2Z","modified":"2026-06-17T01:01:03.577Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:54.862898Z"}],"osv":[{"id":"CVE-2017-10993","description":"Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.","status":"published","published":"2017-07-21T06:29:00.2Z","modified":"2026-10-24T10:30:36.957414612Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"GHSA-x5g4-crxq-qxjx","title":"Contao Core directory traversal vulnerability","description":"A logged in back end user can include arbitrary PHP files by manipulating an URL parameter. Since Contao does not allow to upload PHP files in the file manager, the attack is limited to the existing PHP files on the server.","status":"published","published":"2022-05-13T01:42:03Z","modified":"2024-04-25T23:43:34.816106Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:59.484835Z"}]}}