Vulnerability-Lookup

CVE-2026-57232 (GCVE-0-2026-57232)

Vulnerability from cvelistv5 – Published: 2026-07-31 18:29 – Updated: 2026-08-03 17:24

Title

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Summary

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this->feedIo->read($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 17:23 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/contao/contao/security/advisor…	x_refsource_CONFIRM
https://github.com/contao/contao/commit/27f620180…	x_refsource_MISC
https://github.com/contao/contao/commit/53b939ff2…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
contao	contao	Affected: >= 5.7.0-RC1, < 5.7.9 Affected: >= 5.3.35, < 5.3.48	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57232",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T17:23:44.263512Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T17:24:45.798Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "contao",
          "vendor": "contao",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.7.0-RC1, \u003c 5.7.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.3.35, \u003c 5.3.48"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo-\u003eread() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this-\u003efeedIo-\u003eread($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T18:29:53.924Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh"
        },
        {
          "name": "https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f"
        },
        {
          "name": "https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4"
        }
      ],
      "source": {
        "advisory": "GHSA-87mg-5grr-rhwh",
        "discovery": "UNKNOWN"
      },
      "title": "Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57232",
    "datePublished": "2026-07-31T18:29:53.924Z",
    "dateReserved": "2026-06-24T02:21:33.811Z",
    "dateUpdated": "2026-08-03T17:24:45.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-57232",
      "date": "2026-11-14",
      "epss": "0.0029",
      "percentile": "0.21799"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "contao",
                "vendor": "contao",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 5.7.0-RC1, \u003c 5.7.9"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 5.3.35, \u003c 5.3.48"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo-\u003eread() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this-\u003efeedIo-\u003eread($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48."
          }
        ],
        "id": "CVE-2026-57232",
        "lastModified": "2026-09-08T20:51:43.490",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-57232",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T17:23:44.263512Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-31T19:17:11.423",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-57232",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-03T17:23:44.263512Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-03T17:23:57.514Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "contao",
              "vendor": "contao",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 5.7.0-RC1, \u003c 5.7.9"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 5.3.35, \u003c 5.3.48"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo-\u003eread() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this-\u003efeedIo-\u003eread($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-31T18:29:53.924Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh"
            },
            {
              "name": "https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f"
            },
            {
              "name": "https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4"
            }
          ],
          "source": {
            "advisory": "GHSA-87mg-5grr-rhwh",
            "discovery": "UNKNOWN"
          },
          "title": "Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-57232",
        "datePublished": "2026-07-31T18:29:53.924Z",
        "dateReserved": "2026-06-24T02:21:33.811Z",
        "dateUpdated": "2026-08-03T17:24:45.798Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-57232

Vulnerability from fkie_nvd - Published: 2026-07-31 19:17 - Updated: 2026-09-08 20:51

Severity

3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f
	security-advisories@github.com	https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4
	security-advisories@github.com	https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "contao",
          "vendor": "contao",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.7.0-RC1, \u003c 5.7.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.3.35, \u003c 5.3.48"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo-\u003eread() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this-\u003efeedIo-\u003eread($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48."
    }
  ],
  "id": "CVE-2026-57232",
  "lastModified": "2026-09-08T20:51:43.490",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-57232",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-03T17:23:44.263512Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-31T19:17:11.423",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-87MG-5GRR-RHWH

Vulnerability from github – Published: 2026-09-24 19:59 – Updated: 2026-09-24 19:59

Summary

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Details

Summary

The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this->feedIo->read($url) without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services, cloud-provider metadata endpoints, or loopback addresses, causing the server to fetch those resources unconditionally. Confirmed live: the server successfully reaches the internal MySQL database container and its own loopback Apache instance.

Details

In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client with no validation:

// Line 50-55
foreach (StringUtil::trimsplit('[\n\t ]', trim($model->rss_feed)) as $url) {
    try {
        $feed = $this->cache->get(
            'feed_reader_'.$model->id.'_'.md5($url),
            function (ItemInterface $item) use ($url, $model) {
                $readerResult = $this->feedIo->read($url, new Feed()); // <-- no validation

The DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation:

'eval' => array('mandatory'=>true, 'decodeEntities'=>true, 'style'=>'height:60px')

The HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured (NoPrivateNetworkHttpClient is not used).

Impact

This is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:

Enumerate internal network services -- probe any IP/port on the internal network by observing response times and error messages
Reach internal APIs -- access unauthenticated services inside the Docker/Kubernetes network (databases, caches, admin panels)
Steal cloud metadata credentials -- on AWS, fetch http://169.254.169.254/latest/meta-data/iam/security-credentials/ to obtain IAM role credentials (IMDSv1 has no authentication)
Pivot to internal infrastructure -- use the server as a proxy to interact with services not exposed to the public internet

Confirmed in live testing: the server successfully connected to the internal MySQL container (172.19.0.3:3306) and retrieved a full HTTP response from its own loopback interface (127.0.0.1:80).

Remediation

Use NoPrivateNetworkHttpClient -- wrap the injected HTTP client with Symfony's built-in SSRF protection before passing it to feedIo: ```php use Symfony\Component\HttpClient\NoPrivateNetworkHttpClient;

$safeClient = new NoPrivateNetworkHttpClient($this->httpClient); ``` This blocks all RFC-1918, loopback, and link-local addresses at the HTTP client level.

Validate URL scheme and host -- before calling feedIo->read(), parse the URL and reject anything that is not http:// or https:// with a public routable IP or hostname.
Configure the DCA field -- add 'rgxp' => 'url' and a custom validation callback to tl_module.rss_feed to reject non-public URLs at save time.

Severity

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "contao/contao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3.35"
            },
            {
              "fixed": "5.3.48"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "contao/contao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.4.0"
            },
            {
              "fixed": "5.7.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "contao/core-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3.35"
            },
            {
              "fixed": "5.3.48"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "contao/core-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.4.0"
            },
            {
              "fixed": "5.7.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-24T19:59:16Z",
    "nvd_published_at": "2026-07-31T19:17:11Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nThe Feed Reader front-end module passes RSS feed URLs from its configuration directly to `$this-\u003efeedIo-\u003eread($url)` without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services, cloud-provider metadata endpoints, or loopback addresses, causing the server to fetch those resources unconditionally. Confirmed live: the server successfully reaches the internal MySQL database container and its own loopback Apache instance.\n\n---\n\n### Details\n\nIn `core-bundle/src/Controller/FrontendModule/FeedReaderController.php`, the `getResponse()` function iterates over the configured feed URLs and passes each one directly to the HTTP client with no validation:\n\n```php\n// Line 50-55\nforeach (StringUtil::trimsplit(\u0027[\\n\\t ]\u0027, trim($model-\u003erss_feed)) as $url) {\n    try {\n        $feed = $this-\u003ecache-\u003eget(\n            \u0027feed_reader_\u0027.$model-\u003eid.\u0027_\u0027.md5($url),\n            function (ItemInterface $item) use ($url, $model) {\n                $readerResult = $this-\u003efeedIo-\u003eread($url, new Feed()); // \u003c-- no validation\n```\n\nThe DCA field definition for `rss_feed` in `tl_module.php` carries no URL scheme or host validation:\n```php\n\u0027eval\u0027 =\u003e array(\u0027mandatory\u0027=\u003etrue, \u0027decodeEntities\u0027=\u003etrue, \u0027style\u0027=\u003e\u0027height:60px\u0027)\n```\n\nThe HTTP client is wired as `@psr18.http_client` (Symfony HttpClient) with no SSRF protection configured (`NoPrivateNetworkHttpClient` is not used).\n\n---\n\n### Impact\n\nThis is a CWE-918 (SSRF) vulnerability. A backend user with module-edit access can:\n\n1. **Enumerate internal network services** -- probe any IP/port on the internal network by observing response times and error messages\n2. **Reach internal APIs** -- access unauthenticated services inside the Docker/Kubernetes network (databases, caches, admin panels)\n3. **Steal cloud metadata credentials** -- on AWS, fetch `http://169.254.169.254/latest/meta-data/iam/security-credentials/` to obtain IAM role credentials (IMDSv1 has no authentication)\n4. **Pivot to internal infrastructure** -- use the server as a proxy to interact with services not exposed to the public internet\n\nConfirmed in live testing: the server successfully connected to the internal MySQL container (`172.19.0.3:3306`) and retrieved a full HTTP response from its own loopback interface (`127.0.0.1:80`).\n\n---\n\n### Remediation\n\n1. **Use `NoPrivateNetworkHttpClient`** -- wrap the injected HTTP client with Symfony\u0027s built-in SSRF protection before passing it to feedIo:\n   ```php\n   use Symfony\\Component\\HttpClient\\NoPrivateNetworkHttpClient;\n\n   $safeClient = new NoPrivateNetworkHttpClient($this-\u003ehttpClient);\n   ```\n   This blocks all RFC-1918, loopback, and link-local addresses at the HTTP client level.\n\n2. **Validate URL scheme and host** -- before calling `feedIo-\u003eread()`, parse the URL and reject anything that is not `http://` or `https://` with a public routable IP or hostname.\n\n3. **Configure the DCA field** -- add `\u0027rgxp\u0027 =\u003e \u0027url\u0027` and a custom validation callback to `tl_module.rss_feed` to reject non-public URLs at save time.",
  "id": "GHSA-87mg-5grr-rhwh",
  "modified": "2026-09-24T19:59:16Z",
  "published": "2026-09-24T19:59:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57232"
    },
    {
      "type": "WEB",
      "url": "https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4"
    },
    {
      "type": "WEB",
      "url": "https://contao.org/en/security-advisories/server-side-request-forgery-via-unvalidated-rss-feed-urls"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2026-57232.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2026-57232.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/contao/contao"
    },
    {
      "type": "WEB",
      "url": "https://github.com/contao/contao/releases/tag/5.3.48"
    },
    {
      "type": "WEB",
      "url": "https://github.com/contao/contao/releases/tag/5.7.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module"
}

WID-SEC-W-2026-2287

Vulnerability from csaf_certbund - Published: 2026-07-12 22:00 - Updated: 2026-08-02 22:00

Summary

Contao: Schwachstelle ermöglicht Offenlegung von Informationen

Severity

Niedrig

Scope

1 vulnerability in this advisory, including CVE-2026-57232.

CVE-2026-57232

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-57232 (GCVE-0-2026-57232)

FKIE_CVE-2026-57232

GHSA-87MG-5GRR-RHWH

Summary

Details

Impact

Remediation

WID-SEC-W-2026-2287

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour