CVE-2023-29200mediumCWE-22

CVE-2023-29200: medium-severity vulnerability in contao

contao/core-bundle has path traversal vulnerability in the file manager

Published · Updated

Follow this CVE+ Monitor contao+ Monitor contao/contao

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.8%
Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
contao · contao
Related CVEs — contao

In the same product, most dangerous first.

CVE-2022-24899HIGHCross site scripting via canonical tagEPSS 4.5%CVE-2021-37626HIGHPHP file inclusion via insert tagsEPSS 1.3%CVE-2021-37627HIGHPrivilege escalation via form generatorEPSS 1.0%CVE-2012-4383—CVE-2012-4383EPSS 0.9%CVE-2024-28235HIGHContao possible cookie sharing with external domains while checking protected pages for broken linksEPSS 0.7%CVE-2023-36806MEDIUMContao cross site scripting vulnerability via input unit widgetEPSS 0.6%