| Package | Affected versions | Patched versions |
|---|---|---|
| contao/contao | ≥ 5.0.0-RC1, < 5.3.38≥ 5.4.0-RC1, < 5.6.1 | 5.3.385.6.1 |
| contao/core-bundle | ≥ 5.0.0-RC1, < 5.3.38≥ 5.4.0-RC1, < 5.6.1 | 5.3.385.6.1 |
| contao | ≥ 5.3.0, < 5.3.38≥ 5.4.0, < 5.6.1 | 5.3.385.6.1 |
If a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed.
Update to Contao 5.3.38 or 5.6.1.
Do not add protected news archives to the news feed page.
If you have any questions or comments about this advisory, open an issue in contao/contao.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free