CVE-2021-37626

CVE-2021-37626 affects Contao, a PHP-based CMS. The vulnerability allows loading arbitrary PHP files via insert tags in the backend when untrusted users can modify fields shown on the frontend. Affected versions include Contao releases up to 4.4.55, 4.9.17, and 4.11.6; remediation is to update to...

PHP file inclusion via insert tags

Date : 2021-08-11 CVE ID : CVE-2021-37626 Description It is possible for untrusted users to load arbitrary PHP files via insert tags. Installations are only affected if there are untrusted back end users. Affected versions Contao 4.0 Contao 4.1 Contao 4.2 Contao 4.3 Contao 4.4 up to 4.4.55 Contao...