PT-2024-31859 · Contao · Contao

Published 2024-10-02 · Updated 2025-11-13 · CVE-2024-45965

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contao version 5.4.1

Description The issue allows an authenticated admin account to upload a SVG file containing malicious javascript code into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted javascript to the target.

Recommendations For Contao version 5.4.1, consider disabling the SVG file upload feature for admin accounts until a patch is available to prevent potential Cross-Site Scripting (XSS) attacks or arbitrary code execution. Restrict access to the file upload module to minimize the risk of exploitation. Avoid accessing SVG files uploaded by admin accounts through the website until the issue is resolved.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2024-45965

GHSA-MRW8-5368-PHM3

Affected Products

Contao

References · 11

• 🔥 https://grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb · Exploit
• https://osv.dev/vulnerability/GHSA-mrw8-5368-phm3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45965 · Vendor Advisory
• https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45965 · Security Note
• https://github.com/contao/contao · Note
• https://twitter.com/CVEnew/status/1841566856332902813 · Twitter Post
• https://t.me/cvenotify/115977 · Telegram Post
• https://t.me/cvedetector/6878 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1841615239369965675 · Twitter Post
• https://t.me/cveNotify/142646 · Telegram Post