GHSA-vm6r-j788-hjh5 Contao affected by remote command execution through file upload

• Packagist contao/core-bundle: >= 4.0.0, < 4.13.49 → fixed in 4.13.49 • Packagist contao/core-bundle: >= 5.0.0, < 5.3.15 → fixed in 5.3.15 • Packagist contao/core-bundle: >= 5.4.0, < 5.4.3 → fixed in 5.4.3

Impact Back end users with access to the file manager can upload malicious files and execute them on the server. Patches Update to Contao 4.13.49, 5.3.15 or 5.4.3. Workarounds Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory. References https://contao.org/en/security-advisories/remote-command-execution-through-file-uploads For more information If you have any questions or comments about this advisory, open an issue in contao/contao. Credits Thanks to Jakob Steeg from usd AG for reporting this vulnerability.