Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| contao/core-bundle(Packagist) | 4.0.0 | 4.13.54 | N/A |
| contao/core-bundle(Packagist) | 5.3.0 | 5.3.30 | N/A |
| contao/core-bundle(Packagist) | 5.4.0 | 5.5.6 | N/A |
CVSS Metrics
