CVE-2026-57232
Received Received - Intake

Contao CMS Server-Side Request Forgery via Feed Reader

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo->read() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this->feedIo->read($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-08-01
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-57232
EUVD
EUVD-2026-51596

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
contao contao From 5.3.35 (inc) to 5.3.47 (inc)
contao contao From 5.7.0-rc1 (inc) to 5.7.8 (inc)
contao contao 5.3.48

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Contao CMS versions 5.3.35 through 5.3.47 and 5.7.0-RC1 through 5.7.8 allows a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints via the Feed Reader front-end module. The issue occurs because the FeedReaderController::getResponse() function passes RSS feed URLs directly to an HTTP client without validating the scheme or private addresses.

Detection Guidance

Check Contao CMS versions between 5.3.35-5.3.47 and 5.7.0-RC1-5.7.8 for Feed Reader module usage. Inspect server logs for outbound requests to internal IPs, loopback addresses, or cloud metadata endpoints originating from Contao. Review FeedReaderController.php for direct URL passing to feedIo without validation.

Impact Analysis

An attacker with backend access could exploit this to send requests to internal systems, potentially accessing sensitive data or services. This could lead to unauthorized information disclosure or further network compromise. The impact is limited to users with module-edit permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected Contao versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade Contao CMS to version 5.3.48 or later. Disable the Feed Reader module if unused. Implement URL scheme and host validation for RSS feed inputs. Configure Symfony HttpClient with NoPrivateNetworkHttpClient for SSRF protection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart