CVEvulnerability

CVE-2021-37626

7.2 HIGH Published 2021-08-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-08-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-94

Description

Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify fields that are shown in the front end. Update to Contao 4.4.56, 4.9.18 or 4.11.7 to resolve. If you cannot update then disable the login for untrusted back end users.

Affected configurations

• contao contao (>= 4.4.0 < 4.4.56) • contao contao (>= 4.9.0 < 4.9.18) • contao contao (>= 4.11.0 < 4.11.7) • contao contao 4.0.0 • contao contao 4.1.0 • contao contao 4.2.0 • contao contao 4.3.0 • contao contao 4.5.0 • contao contao 4.6.0 • contao contao 4.7.0 • contao contao 4.8.0 • contao contao 4.10.0

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References