What’s Vulnerable › Vulnerabilities

CVE-2022-24899: Cross site scripting via canonical tag

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-06 · updated 2026-06-17
• Weakness: CWE-79

Description

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.

Affected products

• contao: from 4.13.0 through 4.13.2

References

• https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
• https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c
• https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
• https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
• https://github.com/contao/contao/commit/199206849a87ddd0fa5cf674eb3c58292fd8366c
• https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2

Get alerted when CVE-2022-24899 or the next vulnerability affects your stack