CVE-2024-45965

No fix known EPSS <1%CVSS 6.4

Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.

Published 2024-10-02 · CVE record · OSV

Products: contao

Fixed upstream