GitHub Advisoryadvisory · Packagist

GHSA-wjx8-cgrm-hh8p Unrestricted file uploads in Contao

HIGH Published 2019-12-17 Modified 2024-04-22 Official page ↗
Aliases
CVE-2019-19745
Ecosystem
Packagist
Packages
contao/core-bundle, contao/contao
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2019-12-17

Affected packages

• Packagist contao/core-bundle: >= 4.0.0, < 4.4.46 → fixed in 4.4.46 • Packagist contao/core-bundle: >= 4.5.0, < 4.8.6 → fixed in 4.8.6 • Packagist contao/contao: >= 4.0.0, < 4.4.46 → fixed in 4.4.46 • Packagist contao/contao: >= 4.5.0, < 4.8.6 → fixed in 4.8.6

Description

Impact A back end user with access to the form generator can upload arbitrary files and execute them on the server. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory. References https://contao.org/en/security-advisories/unrestricted-file-uploads For more information If you have any questions or comments about this advisory, open an issue in contao/contao.

Related

Alias · CVE (1)

  • CVE-2019-19745 Contao 4.0 through 4.8.5 allows PHP local file inclusion. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References