PatchClock

PHP security digest · Packages

contao/core-bundle security advisories

7 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Medium 9 Oct 2026

    Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

    Fixed in 5.3.50, 5.7.12 · CVE-2026-107842

  2. Medium 9 Oct 2026

    Contao: The registration module re-sends activation mails

    Fixed in 5.3.50, 5.7.12 · CVE-2026-107843

  3. Low 9 Oct 2026

    Contao: Cross-site request forgery in custom backend actions

    Fixed in 5.3.50, 5.7.12 · CVE-2026-107848

  4. Medium 9 Oct 2026

    Contao: Path traversal in the images controller

    Fixed in 5.3.50, 5.7.12 · CVE-2026-107844

  5. Medium 9 Oct 2026

    Contao: Improper access control in the preview links module

    Fixed in 5.7.12 · CVE-2026-107850

  6. Medium 9 Oct 2026

    Contao: Improper access control in the table access voter

    Fixed in 5.7.12 · CVE-2026-107851

  7. Low 24 Sep 2026

    Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

    Fixed in 5.3.48, 5.7.9 · CVE-2026-57232

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including contao/core-bundle, and the version that fixes it.