CVE-2026-57232
Description
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this->feedIo->read($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.
How to fix
- contao/contao5.3.48, 5.7.9 or later
- contao/core-bundle5.3.48, 5.7.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| contao/contaoPackagist | 5.3.35 ≤ v < 5.3.48, 5.4.0 ≤ v < 5.7.9 | 5.3.48, 5.7.9 |
| contao/core-bundlePackagist | 5.3.35 ≤ v < 5.3.48, 5.4.0 ≤ v < 5.7.9 | 5.3.48, 5.7.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.