Vulnerability · Published Aug 11, 2021 · Assigned by GitHub_M
CVE-2021-37626PHP file inclusion via insert tags
High 7.2
In plain English
A high-severity code injection in contao from contao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify fields that are shown in the front end. Update to Contao 4.4.56, 4.9.18 or 4.11.7 to resolve. If you cannot update then disable the login for untrusted back end users.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | contao/contao | 4.4.56 | GHSA-r6mv-ppjc-4hgr |
| Packagist | contao/contao | 4.9.18 | GHSA-r6mv-ppjc-4hgr |
| Packagist | contao/contao | 4.11.7 | GHSA-r6mv-ppjc-4hgr |
| Packagist | contao/core-bundle | 4.4.56 | GHSA-r6mv-ppjc-4hgr |
| Packagist | contao/core-bundle | 4.9.18 | GHSA-r6mv-ppjc-4hgr |
| Packagist | contao/core-bundle | 4.11.7 | GHSA-r6mv-ppjc-4hgr |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H