contao/core-bundle

Contao Open Source CMS

Latest 6.0.4

91%

Total Score

healthy

Long-running, actively released project with broad contributor activity; only workflow pinning and security-tooling gaps lower confidence.

Are you affected? Scan for Free

Health Score Breakdown

Repo tooling

Composer build tooling is present, but no automated security-scanning tool is reported. This is a modest transparency and maintenance gap, not evidence of unsafe code.

Workflow audit

The single workflow was fully analyzed with no findings or untrusted sinks, but its only action use is unpinned, leaving dependency resolution less reproducible.

Vulnerabilities

Title	Versions	Severity
CVE-2026-107842 New contao/core-bundle is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 4.0.0 - 5.3.50 and 5.4.0-RC1 - 5.7.12.	4.0.0 - 5.3.505.4.0-RC1 - 5.7.12	Medium
CVE-2026-107843 New contao/core-bundle is vulnerable to Observable Response Discrepancy in versions 4.1.0 - 5.3.50 and 5.4.0-RC1 - 5.7.12.	4.1.0 - 5.3.505.4.0-RC1 - 5.7.12	Medium
CVE-2026-107848 New contao/core-bundle is vulnerable to Cross-Site Request Forgery (CSRF) in versions 4.0.0 - 5.3.50 and 5.4.0-RC1 - 5.7.12.	4.0.0 - 5.3.505.4.0-RC1 - 5.7.12	Low
CVE-2026-107844 New contao/core-bundle is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 4.1.0 - 5.3.50 and 5.4.0-RC1 - 5.7.12.	4.1.0 - 5.3.505.4.0-RC1 - 5.7.12	Medium
CVE-2026-107850 New contao/core-bundle is vulnerable to Authorization Bypass Through User-Controlled Key in versions 5.7.1 - 5.7.12.	5.7.1 - 5.7.12	Medium

Package versions

Maintainers

Leo Feyer

Contao Community

Direct Dependencies

Dependency	Last Release	Score
psr/log Version ^1.1 \|\| 2.0 \|\| ^3.0	—	—
psr/cache Version ^3.0	—	—
twig/twig Version ^3.21	—	—
cmsig/seal Version ^0.12.2	—	—
nyholm/psr7 Version ^1.2	—	—