Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Contao allows attackers to insert malicious code via canonical tag

CVE-2022-24899 · published 4 years ago
Summary

Versions of Contao before 4.13.3 let a user add unwanted code into the page's canonical tag, which can cause harmful scripts to run in a visitor's browser. This could allow an attacker to steal data or manipulate what the user sees. Upgrade Contao to version 4.13.3 or newer, or temporarily turn off canonical tags in the root page settings until you can update.

What to do
  • Update contao core-bundle to version 4.13.3.
  • Update contao contao to version 4.13.3.
Affected software
Ecosystem VendorProductAffected versions
composer contao core-bundle >= 4.13.0, < 4.13.3
Fix: upgrade to 4.13.3
composer contao contao >= 4.13.0, < 4.13.3
Fix: upgrade to 4.13.3
– contao contao >= 4.13.0, <= 4.13.2
cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*
Original advisory text
Cross site scripting via canonical tag
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.2 High
Exploitation
4% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published5 May 2022
Updated24 Oct 2026
First seen6 Mar 2026
Sources
GHSA-m8x6-6r63-qvj2 · GHSA
CVE-2022-24899 · NVD
CVE-2022-24899 · OSV
Track software like this
Free during beta