Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-107843 · GHSA-mfxh-vp55-7gc6

Contao: The registration module re-sends activation mails

Risk score
40/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.3%
Published
9 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::sen…
Affected
contao/core-bundle (composer) >= 4.1.0, < 5.3.50; contao/core-bundle (composer) >= 5.4.0-RC1, < 5.7.12
Fix
Upgrade contao/core-bundle to 5.3.50 or 5.7.12 (whichever matches your release line) or later.
Exploitation
No known exploitation

Story map

Story map: contao/core-bundleTHE FLAWSTHE FIXCVE-2026-107843Contao: The registrationmodule re-sends activationmailsCVSS 5.3 · EPSS 0%CVE-2026-107844Contao: Path traversal in theimages controllerCVSS 5.3 · EPSS 0%CVE-2026-107842Contao: Protected pagecontent is disclosed toanonymous visitors after…CVSS 5.3 · EPSS 0%Upgrade contao/core-bundle5.3.50 · 5.7.12or later on your release lineWho is exposedcontao/core-bundle (composer)>= 4.1.0, < 5.3.50;contao/core-bundle (composer)>= 5.4.0-RC1, < 5.7.12YELLOW · PLAN IT INcontao/core-bundleContao is an Open Source CMS.From version 5.0.0 until 5.3.50and 5.7.12, ImagesControllerjoins the user-controlled {path}parameter to the configuredimage target directory withPath::join() but does not use…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-204 (CWE-204)6 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

contao/core-bundle: Yellow, plan it in. Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBasePath() to verify that the canonical path remains inside that directory. An unauthenticated reques…

The flaws

  • CVE-2026-107843: Contao: The registration module re-sends activation mails (CVSS 5.3 · EPSS 0%)
  • CVE-2026-107844: Contao: Path traversal in the images controller (CVSS 5.3 · EPSS 0%)
  • CVE-2026-107842: Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled (CVSS 5.3 · EPSS 0%)

The fix

Upgrade contao/core-bundle: 5.3.50 · 5.7.12 or later on your release line

Who is exposed: contao/core-bundle (composer) >= 4.1.0, < 5.3.50; contao/core-bundle (composer) >= 5.4.0-RC1, < 5.7.12

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: Composer

Affected packages

PackageEcosystemVulnerableFixed in
contao/core-bundlecomposer>= 4.1.0, < 5.3.505.3.50
contao/core-bundlecomposer>= 5.4.0-RC1, < 5.7.125.7.12

References

Original description

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the preceding captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to cause repeated activation emails to be sent to an address with a pending registration and to determine whether that pending registration exists. The branch is reachable only when reg_activate is enabled and the target has an unconfirmed registration and opt-in token. This issue is fixed in versions 5.3.50 and 5.7.12.

Last activity 9 Oct 2026. Patch Forecast updates every hour.