contao/comments-bundle
Packagist2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting contao/comments-bundlepage 1 of 1
- CVE-2024-28234MEDIUMCVSS 4.3EG 4.3fixed in 4.13.40 or 5.3.4, by version range2024-04-09
vulnerable: 5.0.0 ... 5.3.3 (55 versions)
Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao…
- CVE-2026-107845CRITICALCVSS 9.3EG 9.3fixed in 5.3.50 or 5.7.12, by version range2026-10-09
vulnerable: 5.4.0 ... 5.7.9 (71 versions)
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in commen…
Check whether contao/comments-bundle is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for contao/comments-bundle CVEs against the assets you own.
Book a Demo →