Contao affected by directory traversal in the file selector widget

Description

References

• contao/contao security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2024-45604 · ADVISORY
• contao/contao commit 63409c6 · WEB
• contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget · WEB
• contao/contao · PACKAGE

More vulnerabilities in contao/core-bundle

• CVE-2026-107851MEDIUM 4.3Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataC…
• CVE-2026-107850MEDIUM 4.3Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao…
• CVE-2026-107848LOW 3.5Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST request…
• CVE-2026-107844MEDIUM 5.3Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the…
• CVE-2026-107843MEDIUM 5.3Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration br…