CVE-2017-10993

HIGH

Contao < 3.5.28 and 4.x < 4.4.1 - Remote Code Execution via Directory Traversal

Title source: llm
STIX 2.1

Description

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://contao.org/en/news/contao-3_5_28.html

Scores

CVSS v3 8.8
EPSS 0.0196
EPSS Percentile 77.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (31)
contao/contao 4.0.0 - 4.4.1Packagist
contao/contao_cms 4.0.0 (3 CPE variants)
contao/contao_cms 4.0.1
contao/contao_cms 4.0.2
contao/contao_cms 4.0.3
contao/contao_cms 4.0.4
contao/contao_cms 4.1.0 (3 CPE variants)
contao/contao_cms 4.1.1
contao/contao_cms 4.1.2
contao/contao_cms 4.1.3
... and 21 more
Published Jul 21, 2017
Tracked Since Feb 18, 2026