CVE-2026-107848: falha de baixa gravidade em contao
Contao: Cross-site request forgery in custom backend actions
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.5epss 0.1%
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Produtos afetados
contao · contaoCVEs relacionadas — contao
No mesmo produto, das mais perigosas para as menos.
CVE-2022-24899HIGHCross site scripting via canonical tagEPSS 4.5%CVE-2021-37626HIGHPHP file inclusion via insert tagsEPSS 1.3%CVE-2021-37627HIGHPrivilege escalation via form generatorEPSS 1.0%CVE-2012-4383—CVE-2012-4383EPSS 0.9%CVE-2023-29200MEDIUMcontao/core-bundle has path traversal vulnerability in the file managerEPSS 0.8%CVE-2024-28235HIGHContao possible cookie sharing with external domains while checking protected pages for broken linksEPSS 0.7%