DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-57232: CVE-2026-57232: Server-Side Request Forgery in Contao CMS Feed Reader Module

#security #cve #cybersecurity

CVE-2026-57232: Server-Side Request Forgery in Contao CMS Feed Reader Module

Vulnerability ID: CVE-2026-57232
CVSS Score: 3.1
Published: 2026-09-24

A Server-Side Request Forgery (SSRF) vulnerability exists in the Contao Open Source Content Management System (CMS) within the Feed Reader front-end module. When processing RSS feed configurations, the module initiates outbound HTTP connections using a default HTTP client that lacks loopback and private network controls. Authenticated backend users with permissions to configure frontend modules can exploit this flaw to coerce the server into sending requests to internal endpoints, loopback addresses, and cloud instance metadata services.

TL;DR

An authenticated backend SSRF vulnerability in the Contao CMS Feed Reader module allows users with module-editing privileges to force the host server to scan or interact with private internal networks and cloud metadata endpoints.

Technical Details

  • CWE ID: CWE-918 (Server-Side Request Forgery)
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 3.1 (Low)
  • EPSS Score: 0.0029 (0.29% percentile: 19.12%)
  • Impact: Low Confidentiality (C:L), No Integrity (I:N), No Availability (A:N)
  • Exploit Status: No public exploits or weaponized PoCs available
  • KEV Status: Not listed in CISA KEV Catalog

Affected Systems

  • Contao Open Source CMS
  • Contao core-bundle: >= 5.3.35, <= 5.3.47 (Fixed in: 5.3.48)
  • Contao core-bundle: >= 5.7.0-RC1, <= 5.7.8 (Fixed in: 5.7.9)

Code Analysis

Commit: 27f6201

Vulnerability Patch Commit (Main) - Introduces the NoPrivateNetworkExceptRootPagesHttpClient class to validate target destinations.

Commit: 53b939f

Vulnerability Patch Commit (Redirect Reimplementation) - Disables native client redirects and enforces manual IP checks on every redirect hop.

Mitigation Strategies

  • Upgrade Contao CMS to version 5.3.48 or 5.7.9 immediately to apply the secure HTTP client decorator.
  • Restrict Contao backend user permissions to prevent unauthorized users from creating or editing Feed Reader modules.
  • Implement network egress filtering rules to restrict the web server from contacting local private subnets and metadata services.

Remediation Steps:

  1. Navigate to the root directory of the Contao installation.
  2. Execute composer update contao/core-bundle to pull the latest security release.
  3. Verify the installed version of contao/core-bundle is either 5.3.48 or 5.7.9 using composer show contao/core-bundle.
  4. Clear the application cache by running php vendor/bin/contao-console cache:clear.
  5. Restart the PHP-FPM or Apache web server service to apply updates.

References

Read the full report for CVE-2026-57232 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)