CVE-2017-10993

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2017-07-21

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Contao Cms (Contao)

References

• https://contao.org/en/news/contao-3_5_28.html