Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107842 · GHSA-x2rp-9qf7-2fmq

Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

Risk score
40/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.3%
Published
9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but di…
Affected
contao/core-bundle (composer) >= 4.0.0, < 5.3.50; contao/core-bundle (composer) >= 5.4.0-RC1, < 5.7.12
Fix
Upgrade contao/core-bundle to 5.3.50 or 5.7.12 (whichever matches your release line) or later.
Exploitation
No known exploitation

Story map

Story map: contao/core-bundleTHE FLAWSTHE FIXCVE-2026-107842Contao: Protected pagecontent is disclosed toanonymous visitors after…CVSS 5.3 · EPSS 0%CVE-2026-107844Contao: Path traversal in theimages controllerCVSS 5.3 · EPSS 0%CVE-2026-107843Contao: The registrationmodule re-sends activationmailsCVSS 5.3 · EPSS 0%Upgrade contao/core-bundle5.3.50 · 5.7.12or later on your release lineWho is exposedcontao/core-bundle (composer)>= 4.1.0, < 5.3.50;contao/core-bundle (composer)>= 5.4.0-RC1, < 5.7.12YELLOW · PLAN IT INcontao/core-bundleContao is an Open Source CMS.From version 5.0.0 until 5.3.50and 5.7.12, ImagesControllerjoins the user-controlled {path}parameter to the configuredimage target directory withPath::join() but does not use…Where it standsNo known exploitationCONNECTS TOSame weaknessInformation disclosure (CWE-200)198 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

contao/core-bundle: Yellow, plan it in. Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBasePath() to verify that the canonical path remains inside that directory. An unauthenticated reques…

The flaws

  • CVE-2026-107842: Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled (CVSS 5.3 · EPSS 0%)
  • CVE-2026-107844: Contao: Path traversal in the images controller (CVSS 5.3 · EPSS 0%)
  • CVE-2026-107843: Contao: The registration module re-sends activation mails (CVSS 5.3 · EPSS 0%)

The fix

Upgrade contao/core-bundle: 5.3.50 · 5.7.12 or later on your release line

Who is exposed: contao/core-bundle (composer) >= 4.1.0, < 5.3.50; contao/core-bundle (composer) >= 5.4.0-RC1, < 5.7.12

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: Composer

Affected packages

PackageEcosystemVulnerableFixed in
contao/core-bundlecomposer>= 4.0.0, < 5.3.505.3.50
contao/core-bundlecomposer>= 5.4.0-RC1, < 5.7.125.7.12

References

Original description

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. The protected pages continue to return an authorization response, so this issue exposes search metadata and indexed text rather than bypassing page access. This issue is fixed in versions 5.3.50 and 5.7.12.

Last activity 9 Oct 2026. Patch Forecast updates every hour.