| Package | Affected versions | Patched versions |
|---|---|---|
| contao/core-bundle | ≥ 4.0.0, < 4.13.40≥ 5.0.0-RC1, < 5.3.4 | 4.13.405.3.4 |
| contao | ≥ 4.0.0, < 4.13.40≥ 5.0.0, < 5.3.4 | 4.13.405.3.4 |
Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the backend.
Update to Contao 4.13.40 or Contao 5.3.4.
Disable uploads for untrusted users.
https://contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager
If you have any questions or comments about this advisory, open an issue in contao/contao.
Thanks to Alexander Wuttke for reporting this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free