CVE-2017-10993
HighSummary
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, known as Directory Traversal.
Risk Assessment
Attackers can exploit this vulnerability to execute malicious code on the server, potentially leading to system compromise or data leakage.
Recommendation
It is recommended to update Contao to version 3.5.28 or 4.4.1 and to review and secure URL parameters in the application.
Other vulnerabilities in Contao
See all- CVE-2026-55825Low
Contao CMS versions 5.7.0 through 5.7.6 contain a cross-job authorization bypass vulnerability. An authenticated backend user can read attachments from other jobs by manipulating the attachment identifier with '../' sequences.
- CVE-2026-57232Low
Contao CMS versions 5.3.35 through 5.3.47 and 5.7.0-RC1 through 5.7.8 contain an SSRF vulnerability in the Feed Reader module. A backend user with module-edit permissions can make the server request internal network services, loopback addresses, or cloud metadata endpoints.
- CVE-2026-55824Low
Contao CMS versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6 contain a credential leakage vulnerability via the crawler. The crawler improperly cleans authentication options, potentially sending credentials to external hosts.
- CVE-2026-48956Medium
An improper access check in Contao allows unauthorized users to display a list of modules in the frontend.
Original NVD description (English source)
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.