UpHeron
All vulnerabilities

Servers and applications

CVE-2021-37626

PHP file inclusion via insert tags

Severity
High 7.2
Published
11 Aug 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.4.56, 4.9.18, 4.11.7
Also known as
GHSA-r6mv-ppjc-4hgr
Sources
NVD, Project advisories (GitHub)

Description

Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify fields that are shown in the front end. Update to Contao 4.4.56, 4.9.18 or 4.11.7 to resolve. If you…

Affected software

SoftwareAffected versions
ContaoServers and applications · cpe:a:contao:contao
  • From 4.11.0 before 4.11.7
  • Version 4.10.0
  • From 4.9.0 before 4.9.18
  • Version 4.8.0
All 12 release lines
  • Version 4.0.0
  • Version 4.1.0
  • Version 4.2.0
  • Version 4.3.0
  • From 4.4.0 before 4.4.56
  • Version 4.5.0
  • Version 4.6.0
  • Version 4.7.0
  • Version 4.8.0
  • From 4.9.0 before 4.9.18
  • Version 4.10.0
  • From 4.11.0 before 4.11.7
ContaoServers and applications · github:contao/contao
  • From 4.0.0 before 4.4.56

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-37626
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-37626
  • GitHub Advisory Database https://github.com/advisories/GHSA-r6mv-ppjc-4hgr
  • github.com https://github.com/contao/contao/security/advisories/GHSA-r6mv-ppjc-4hgr