CVE-2024-28191 - CVE House
Back to Database
Status published Low CVE-2024-28191

Contao may have unencoded insert tags in the frontend

Vulnerability Description

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-28191

Credits & Attribution

No credits recorded in the NVD database.

References

More from contao

View All →
CVE-2025-65961
Contao is vulnerable to cross-site scripting in templates
Low 3.3
CVE-2025-65960
Contao is vulnerable to remote code execution in template closures
Medium 6.6
CVE-2025-57759
Contao has improper privilege management for page and article fields
Medium 4.3
CVE-2025-57758
Contao has improper access control in the back end voters
Medium 4.3
CVE-2025-57757
Contao discloses information in the news module
Medium 5.3

Affected Vendor

Affected Software

contao
Vulnerable Versions:
>= 4.0.0, < 4.13.40, >= 5.0.0, < 5.3.4

Timeline

Official Publish: April 9th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-74

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1562 Impair Defenses
Defense Evasion
T1213 Data from Information Repositories
Collection