Low severity3.1NVD Advisory· Published Apr 9, 2024· Updated Jun 17, 2026
CVE-2024-28191
CVE-2024-28191
Description
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
contao/core-bundlePackagist | >= 4.0.0, < 4.13.40 | 4.13.40 |
contao/core-bundlePackagist | >= 5.0.0-RC1, < 5.3.4 | 5.3.4 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919nvdPatchWEB
- github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016bnvdPatchWEB
- contao.org/en/security-advisories/insert-tag-injection-via-the-form-generatornvdVendor AdvisoryWEB
- github.com/advisories/GHSA-747v-52c4-8vj8ghsaADVISORY
- github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-28191ghsaADVISORY
News mentions
0No linked articles in our index yet.