GitHub Advisoryadvisory · Packagist
GHSA-fp7q-xhhw-6rj3 Path traversal vulnerability in the file manager
HIGH
Official page ↗
- Aliases
- CVE-2023-29200
- Ecosystem
- Packagist
- Packages
- contao/contao
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-22
- Reviewed
- 2023-04-26
Affected packages
• Packagist contao/contao: >= 4.9.0, < 4.9.40 → fixed in 4.9.40
• Packagist contao/contao: >= 4.13.0, < 4.13.21 → fixed in 4.13.21
• Packagist contao/contao: >= 5.1.0, < 5.1.4 → fixed in 5.1.4
Description
Impact
Authenticated users in the back end can list files outside the document root in the file manager.
Patches
Update to Contao 4.9.40, 4.13.21 or 5.1.4.
Workarounds
None.
References
https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Related
Alias · CVE (1)
- CVE-2023-29200 Contao is an open source content management system. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://github.com/contao/contao/security/advisories/GHSA-fp7q-xhhw-6rj3 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-29200 advisory
- https://github.com/contao/contao/commit/6f3e705f4ff23f4419563d09d8485793569f31df web
- https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager web
- https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager.html web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2023-29200.yaml web
- https://github.com/contao/contao package