p PatchFirst

CVE-2026-57232

CVE-2026-57232 · Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this->feedIo->read($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.

CVSS 3.1 · Low · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • contao

    Versions
    • >= 5.7.0-RC1, < 5.7.9: Affected
    • >= 5.3.35, < 5.3.48: Affected

    No fix published

  • contao/contao Packagist

    Versions
    • 5.3.35
    • 5.3.36
    • 5.3.37
    • 5.3.38
    • 5.3.39
    • 5.3.40
    • 5.3.41
    • 5.3.42
    • 5.3.43
    • 5.3.44
    • 5.3.45
    • 5.3.46
    • 5.3.47
    Affected ranges
    • ECOSYSTEM: ≥ 5.3.35, < 5.3.48

    Update to 5.3.48

  • contao/contao Packagist

    Versions
    • 5.4.0
    • 5.4.1
    • 5.4.10
    • 5.4.11
    • 5.4.12
    • 5.4.13
    • 5.4.14
    • 5.4.2
    • 5.4.3
    • 5.4.4
    • 5.4.5
    • 5.4.6
    • 5.4.7
    • 5.4.8
    • 5.4.9
    • 5.5.0
    • 5.5.0-RC1
    • 5.5.0-RC2
    • 5.5.0-RC3
    • 5.5.0-RC4
    • 5.5.1
    • 5.5.10
    • 5.5.11
    • 5.5.12
    • 5.5.13
    • 5.5.14
    • 5.5.15
    • 5.5.16
    • 5.5.2
    • 5.5.3
    • 5.5.4
    • 5.5.5
    • 5.5.6
    • 5.5.7
    • 5.5.8
    • 5.5.9
    • 5.6.0
    • 5.6.0-RC1
    • 5.6.0-RC2
    • 5.6.0-RC3
    • 5.6.1
    • 5.6.10
    • 5.6.11
    • 5.6.2
    • 5.6.3
    • 5.6.4
    • 5.6.5
    • 5.6.6
    • 5.6.7
    • 5.6.8
    • 5.6.9
    • 5.7.0
    • 5.7.0-RC1
    • 5.7.0-RC2
    • 5.7.0-RC3
    • 5.7.0-RC4
    • 5.7.1
    • 5.7.2
    • 5.7.3
    • 5.7.4
    • 5.7.5
    • 5.7.6
    • 5.7.7
    • 5.7.8
    Affected ranges
    • ECOSYSTEM: ≥ 5.4.0, < 5.7.9

    Update to 5.7.9

  • contao/core-bundle Packagist

    Versions
    • 5.3.35
    • 5.3.36
    • 5.3.37
    • 5.3.38
    • 5.3.39
    • 5.3.40
    • 5.3.41
    • 5.3.42
    • 5.3.43
    • 5.3.44
    • 5.3.45
    • 5.3.46
    • 5.3.47
    Affected ranges
    • ECOSYSTEM: ≥ 5.3.35, < 5.3.48

    Update to 5.3.48

  • contao/core-bundle Packagist

    Versions
    • 5.4.0
    • 5.4.1
    • 5.4.10
    • 5.4.11
    • 5.4.12
    • 5.4.13
    • 5.4.14
    • 5.4.2
    • 5.4.3
    • 5.4.4
    • 5.4.5
    • 5.4.6
    • 5.4.7
    • 5.4.8
    • 5.4.9
    • 5.5.0
    • 5.5.0-RC1
    • 5.5.0-RC2
    • 5.5.0-RC3
    • 5.5.0-RC4
    • 5.5.1
    • 5.5.10
    • 5.5.11
    • 5.5.12
    • 5.5.13
    • 5.5.14
    • 5.5.15
    • 5.5.16
    • 5.5.2
    • 5.5.3
    • 5.5.4
    • 5.5.5
    • 5.5.6
    • 5.5.7
    • 5.5.8
    • 5.5.9
    • 5.6.0
    • 5.6.0-RC1
    • 5.6.0-RC2
    • 5.6.0-RC3
    • 5.6.1
    • 5.6.10
    • 5.6.11
    • 5.6.2
    • 5.6.3
    • 5.6.4
    • 5.6.5
    • 5.6.6
    • 5.6.7
    • 5.6.8
    • 5.6.9
    • 5.7.0
    • 5.7.0-RC1
    • 5.7.0-RC2
    • 5.7.0-RC3
    • 5.7.0-RC4
    • 5.7.1
    • 5.7.2
    • 5.7.3
    • 5.7.4
    • 5.7.5
    • 5.7.6
    • 5.7.7
    • 5.7.8
    Affected ranges
    • ECOSYSTEM: ≥ 5.4.0, < 5.7.9

    Update to 5.7.9

Original sources

Check your server →