CVE-2024-45398 json
Remote command execution through file upload in contao/core-bundle
published 2024-09-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2877 , GHSA-vm6r-j788-hjh5
- cvss
- 8.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory.
Patch / fix
- packagist contao/core-bundle 4.13.49, 5.3.15, 5.4.3
- contao contao 4.13.49, 5.3.15, 5.4.3
- contao contao_cms 4.13.49, 5.3.15, 5.4.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
| GitHub | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | contao/core-bundle | >=4.0.0, <4.13.49 >=5.0.0, <5.3.15 >=5.4.0, <5.4.3 |
4.13.49 5.3.15 5.4.3 |
Affected products
- contao contao
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
-
github.com
/contao/contao/commit/9445d509f12a7f1b68a4794dcc5e3e459b363ebb
web
-
github.com
/contao/contao/commit/a7e39f96ac8fdc281f7caaa96e01deb0e24ac7d3
web
-
github.com
/contao/contao/commit/f3db59ffe5a6c0e1f705b3230ebd5ff16865280e
web
-
contao.org
/en/security-advisories/remote-command-execution-through-file-uploads
web, vendor-advisory
-
github.com
/contao/contao/security/advisories/GHSA-vm6r-j788-hjh5
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-45398
advisory
-
github.com
/contao/contao
package
Sources
- CVE List CVE-2024-45398
- GitHub Advisory GHSA-vm6r-j788-hjh5
- NVD CVE-2024-45398
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.