CVE-2026-57232

Name of the Vulnerable Software and Affected Versions Contao versions 5.3.35 through 5.3.47 Contao versions 5.7.0-RC1 through 5.7.8

Description The Feed Reader front-end module fails to validate the scheme or private addresses of configured RSS feed URLs. This occurs because the getResponse() function in FeedReaderController.php passes URLs directly to the read() function of feedIo without validation. Additionally, the rss feed field in tl module.php lacks host validation, and the Symfony HttpClient is used without SSRF (Server-Side Request Forgery) protection. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. This allows a backend user with module-edit permissions to force the server to request internal network services, loopback addresses, or cloud metadata endpoints.

Recommendations Update to version 5.3.48. Update to version 5.3.48.