Impact

It is possible to inject insert tags via the form generator if the submitted form data is output on the page in a specific way.

Patches

Update to Contao 4.13.40 or 5.3.4.

Workarounds

Do not output the submitted form data on the website.

References

https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

References

• GHSA-747v-52c4-8vj8
• https://nvd.nist.gov/vuln/detail/CVE-2024-28191
• contao/contao@388859d
• contao/contao@474a2fc
• https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator