CVE-2024-45604 Directory traversal in the file selector widget in contao/core-bundle

What is CVE-2024-45604?

CVE-2024-45604 is a medium-severity path traversal vulnerability in contao, published on 17 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

Weakness: CWE-22

Which versions are affected by CVE-2024-45604?

2 open source packages ship an affected version, including contao/core-bundle. It affects 1 product.

Products include Contao Contao.

How do I fix CVE-2024-45604?

Upgrade contao/core-bundle to 4.13.49 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-45604 being exploited?

There is no known exploitation of CVE-2024-45604 in the wild and no public exploit code.

Other vulnerabilities in contao

• CVE-2022-26265 Remote Code Execution in Contao Managed Edition Critical 9.8
• CVE-2019-11512 Contao SQL injection in the file manager Critical 9.8
• CVE-2012-4383 Contao core SQL Injection Vulnerability High 8.8
• CVE-2019-19745 Unrestricted file uploads in Contao High 8.8
• CVE-2024-28235 Contao possible cookie sharing with external domains while checking protected pages for broken links High 8.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4p75-5p53-65m9.