CVE-2021-35955: Contao

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.

Affected products

• Contao Contao: from 4.0.0, before 4.4.56 (fixed in 4.4.56); from 4.5.0, before 4.9.18 (fixed in 4.9.18); from 4.10.0, before 4.11.7 (fixed in 4.11.7)

Published 2021-08-12. Last modified 2026-06-17.