CVE-2024-45965: Contao

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.

Affected products

• Contao Contao: from 4.0, before 4.13.54 (fixed in 4.13.54); from 5.0.0, before 5.3.30 (fixed in 5.3.30); from 5.4.0, before 5.5.6 (fixed in 5.5.6)

Published 2024-10-02. Last modified 2026-06-17.