CVE-2026-57232 Details
Description
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this->feedIo->read($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.
A server-side request forgery (SSRF) vulnerability has been identified in the Contao Feed Reader front-end module, affecting versions 5.3.35 through 5.3.47 and 5.7.0-RC1 through 5.7.8. The vulnerability arises because the module passes configured RSS feed URLs directly to the HTTP client without validating the URL scheme or blocking private addresses. This flaw allows a backend user with module-edit permissions to make the server fetch internal network services, loopback addresses, or cloud metadata endpoints. The issue has been confirmed to allow access to internal databases and services.
Users can update to Contao versions 5.3.48 or 5.7.9, where this vulnerability has been patched. Additionally, for future versions, it is recommended to validate URL schemes and hosts before making requests, and to configure the DCA field for RSS feeds to reject non-public URLs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 31, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f | [email protected] | Source CodeVendor |
| https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4 | [email protected] | Source CodeVendor |
| https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Contao | >= 5.3.35, <= 5.3.47 (semver) >= 5.7.0-RC1, <= 5.7.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |