CVE-2019-19745 Unrestricted file uploads in Contao

What is CVE-2019-19745?

CVE-2019-19745 is a high-severity vulnerability in n/a, published on 17 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.

Weakness: CWE-434

Which versions are affected by CVE-2019-19745?

8 open source packages ship an affected version, including contao/contao and contao/core-bundle. It affects 1 product.

Products include Contao Contao.

How do I fix CVE-2019-19745?

Upgrade contao/contao to a fixed version for your release line: 4.4.46 or 4.8.6.

Is CVE-2019-19745 being exploited?

There is no known exploitation of CVE-2019-19745 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-26265 Remote Code Execution in Contao Managed Edition Critical 9.8
• CVE-2019-11512 Contao SQL injection in the file manager Critical 9.8
• CVE-2012-4383 Contao core SQL Injection Vulnerability High 8.8
• CVE-2024-28235 Contao possible cookie sharing with external domains while checking protected pages for broken links High 8.4
• CVE-2024-45398 Remote command execution through file upload in contao/core-bundle High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wjx8-cgrm-hh8p.