Medium severity4.3NVD Advisory· Published Sep 17, 2024· Updated Jun 17, 2026

CVE-2024-45604

Description

Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
contao/core-bundlePackagist	< 4.13.49	4.13.49

Affected products

ghsa-coords
pkg:composer/contao/core-bundle
Range: < 4.13.49
Contao/CMS2 versions
cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*range: <4.13.49
- (no CPE)range: < 4.13.49

Patches

Vulnerability mechanics

References

contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widgetnvdVendor AdvisoryWEB
github.com/advisories/GHSA-4p75-5p53-65m9ghsaADVISORY
github.com/contao/contao/security/advisories/GHSA-4p75-5p53-65m9nvdThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2024-45604ghsaADVISORY
github.com/contao/contao/commit/63409c6bdfd95197d9906e229d765b630d45742eghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000