What’s Vulnerable › Vulnerabilities

CVE-2024-28191: Contao may have unencoded insert tags in the frontend

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-09 · updated 2026-06-17
• Weakness: CWE-74

Description

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.

Affected products

• contao: from 4.0.0 before 4.13.40; from 5.0.0 before 5.3.4 — fixed in 4.13.40, 5.3.4

How to fix

Upgrade to a fixed version: contao 4.13.40, 5.3.4. Check the vendor advisory for mitigations.

References

• https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator
• https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919
• https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b
• https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8
• https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator
• https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919
• https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016b
• https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8

Get alerted when CVE-2024-28191 or the next vulnerability affects your stack