CVE-2023-29200

    Dashboard / Vulnerabilities / CVE-2023-29200

    CVE-2023-29200

    Published: 25 Apr 2023Last Modified: 12 Aug 2026

    Summary: contao/core-bundle has path traversal vulnerability in the file manager

    Details: Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.

    References: https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29200.json, https://github.com/contao/contao/security/advisories/GHSA-fp7q-xhhw-6rj3, https://nvd.nist.gov/vuln/detail/CVE-2023-29200, https://github.com/contao/contao/commit/6f3e705f4ff23f4419563d09d8485793569f31df

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5f7efb6afd75f7f4fa70f704793c4bc4c0997576

    Affected versions

    4.9.39
    4.9.38
    4.9.37
    4.9.36
    4.9.35
    4.9.34
    4.9.33
    4.9.32
    4.9.31
    4.9.30
    4.9.29
    4.9.28
    4.9.27
    4.9.26
    4.9.25
    4.9.24
    4.9.23
    4.9.22
    4.9.21
    4.9.20
    4.9.19
    4.9.18
    4.9.17
    4.9.15
    4.9.14
    4.9.13
    4.9.12
    4.9.11
    4.9.10
    4.9.9
    4.9.8
    4.9.7
    4.9.6
    4.9.5
    4.9.4
    4.9.3
    4.9.2
    4.9.1
    4.9.0
    4.9.0-RC2
    4.9.0-RC1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-29200 | CVE-DB