Contao SVG Uploads Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in Contao, an open-source content management system. This issue allows users to upload SVG files containing malicious code, which is then executed either in the back end or front end. The vulnerability affects Contao versions 4.0 through 4.12, as well as 5.0 through 5.3.29 and 5.4, up to 5.5.5.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where uploaded SVG files can execute malicious code in the user's browser or the application's back end.

Remediation

Users can upgrade to Contao versions 4.13.54, 5.3.30, or 5.5.6. As a workaround, remove 'svg' and 'svgz' from the allowed upload file types in the system settings and from 'contao.editable_files' in the 'config.yaml'.