SCA: security update for contao/core-bundle (GHSA-9ff2-p842-45wq)

low Tenable Self-Hosted Container Security Plugin ID 474044

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates
REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is
present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token
when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to
modules available to that user, and the advisory demonstrates destructive or state-changing actions rather
than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12. (CVE-2026-107848)

Solution

Update the contao/core-bundle library and its related packages to version 5.3.50 or later.

Plugin Details

Severity: Low

ID: 474044

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/10/2026

Updated: 10/10/2026

Risk Information

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2026-107848

CVSS v3

Risk Factor: Low

Base Score: 3.5

Temporal Score: 3.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/9/2026

Vulnerability Publication Date: 10/9/2026

Reference Information

CVE: CVE-2026-107848

cwe: CWE-352

Detections

Analytics