CVE-2024-45965

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-02 · updated 2026-06-17
Weakness: CWE-434

Description

Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.

Affected products

contao: from 4.0 before 4.13.54; from 5.0.0 before 5.3.30; from 5.4.0 before 5.5.6 — fixed in 4.13.54, 5.3.30, 5.5.6

How to fix

Upgrade to a fixed version: contao 4.13.54, 5.3.30, 5.5.6. Check the vendor advisory for mitigations.

References

https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads
https://grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb

Get alerted when CVE-2024-45965 or the next vulnerability affects your stack