logo

Database

Server side template injection In contao/core

Description

contao/core PHP object injection vulnerability allows for arbitrary code execution PHP object injection vulnerability was identified in contao/core due to untrusted data being passed to deserialize() function.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. GCVE-GHSA-wq43-8r5p-w3mc

References

1. https://github.com/contao/core/issues/66952. https://github.com/contao/core/commit/d67c46c1f1283134e3050244cfdda0ef26fa5cd43. https://github.com/contao/core/commit/f939b5be8a0048ef779def3289e2072febef1b374. https://contao.org/en/news/major-security-hole-found-in-contao.html5. https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/2014-02-13.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.