Critical vulnerabilities
3 critical vulnerabilities in Contao
3 vulnerabilities rated critical (CVSS 9.0 or higher) found on 11 November 2026: Cross-site scripting in servers and applications.
- 3 critical
Contao · Servers and applications
GHSA-5mw8-wv8h-h6hx
Insufficient scope validation for passkey authentication
- Severity
- Critical 9.8
- Published
- 11 Nov 2026
- Fixed in
- 5.7.17
| Software | Affected versions |
|---|---|
| ContaoServers and applications |
|
- GitHub Advisory Database https://github.com/advisories/GHSA-5mw8-wv8h-h6hx
- github.com https://github.com/contao/contao/security/advisories/GHSA-5mw8-wv8h-h6hx
Cross-site scripting in Contao · Servers and applications
GHSA-xh3r-77ch-frm3
Stored cross-site scripting in the file manager via crafted filenames
- Severity
- Critical 9.0
- Published
- 11 Nov 2026
- Fixed in
- 5.3.54
| Software | Affected versions |
|---|---|
| ContaoServers and applications |
|
- GitHub Advisory Database https://github.com/advisories/GHSA-xh3r-77ch-frm3
- github.com https://github.com/contao/contao/security/advisories/GHSA-xh3r-77ch-frm3
Cross-site scripting in Contao · Servers and applications
GHSA-pc2r-hvrc-f4v6
Cross-site scripting in the figure insert tag
- Severity
- Critical 9.0
- Published
- 11 Nov 2026
- Fixed in
- 5.3.54
| Software | Affected versions |
|---|---|
| ContaoServers and applications |
|
- GitHub Advisory Database https://github.com/advisories/GHSA-pc2r-hvrc-f4v6
- github.com https://github.com/contao/contao/security/advisories/GHSA-pc2r-hvrc-f4v6
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.