CVE-2023-29200 contao/core-bundle has path traversal vulnerability in the file manager

What is CVE-2023-29200?

CVE-2023-29200 is a medium-severity path traversal vulnerability in contao, published on 25 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.

Weakness: CWE-22

Which versions are affected by CVE-2023-29200?

6 open source packages ship an affected version, including contao/contao. It affects 1 product.

Products include Contao Contao.

How do I fix CVE-2023-29200?

Upgrade contao/contao to a fixed version for your release line: 4.13.21, 4.9.40 or 5.1.4.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-29200 being exploited?

There is no known exploitation of CVE-2023-29200 in the wild and no public exploit code.

Other vulnerabilities in contao

• CVE-2022-26265 Remote Code Execution in Contao Managed Edition Critical 9.8
• CVE-2019-11512 Contao SQL injection in the file manager Critical 9.8
• CVE-2012-4383 Contao core SQL Injection Vulnerability High 8.8
• CVE-2019-19745 Unrestricted file uploads in Contao High 8.8
• CVE-2024-28235 Contao possible cookie sharing with external domains while checking protected pages for broken links High 8.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fp7q-xhhw-6rj3.