Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Summary The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this-feedIo-read$url without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services,...

CVE-2026-57232: Server-Side Request Forgery (SSRF)

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

CVE-2026-55824: Exposure of Sensitive Information to an Unauthorized Actor

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...

Astra Linux – Vulnerability in symfony

symfony/http-client is a module for the Symphony PHP framework that provides powerful methods for fetching HTTP resources either synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information still leaks during host resolution, which can lead to potential...

Insertion of Sensitive Information Into Sent Data

Overview symfony/http-client is a Symfony HttpClient component. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the request function in NoPrivateNetworkHttpClient, used during host resolution. This can be exploited to enumerate ports or IP...