CVE-2021-37626 - CVE House
Back to Database
Status published High CVE-2021-37626

PHP file inclusion via insert tags

Vulnerability Description

Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify fields that are shown in the front end. Update to Contao 4.4.56, 4.9.18 or 4.11.7 to resolve. If you cannot update then disable the login for untrusted back end users.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-37626

Credits & Attribution

No credits recorded in the NVD database.

References

More from contao

View All →
CVE-2025-65961
Contao is vulnerable to cross-site scripting in templates
Low 3.3
CVE-2025-65960
Contao is vulnerable to remote code execution in template closures
Medium 6.6
CVE-2025-57759
Contao has improper privilege management for page and article fields
Medium 4.3
CVE-2025-57758
Contao has improper access control in the back end voters
Medium 4.3
CVE-2025-57757
Contao discloses information in the news module
Medium 5.3

Affected Vendor

Affected Software

contao
Vulnerable Versions:
>= 4.0.0, < 4.4.56, >= 4.5.0, < 4.9.18, >= 4.10.0, < 4.11.7

Timeline

Official Publish: August 11th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1565.002 Stored Data Manipulation
Impact