{"id":"CVE-2026-57232","summary":"Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module","details":"Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse() to feedIo-\u003eread() without scheme or private-address validation, allowing a backend user with module-edit permissions to make the server request internal network services, loopback addresses, or cloud metadata endpoints. In core-bundle/src/Controller/FrontendModule/FeedReaderController.php, the getResponse() function iterates over the configured feed URLs and passes each one directly to the HTTP client (via $this-\u003efeedIo-\u003eread($url, new Feed())) with no validation, while the DCA field definition for rss_feed in tl_module.php carries no URL scheme or host validation and the HTTP client is wired as @psr18.http_client (Symfony HttpClient) with no SSRF protection configured, since NoPrivateNetworkHttpClient is not used. This issue is fixed in versions 5.3.48.","aliases":["GHSA-87mg-5grr-rhwh"],"modified":"2026-08-02T03:47:48.008190197Z","published":"2026-07-31T18:29:53.924Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57232.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57232.json"},{"type":"ADVISORY","url":"https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57232"},{"type":"FIX","url":"https://github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f"},{"type":"FIX","url":"https://github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/contao/contao","events":[{"introduced":"076a011a04cfee96a4873e1612a1faed4d82e903"},{"fixed":"768c1aba602d0da99a17f7ae912f50cc0e362bb2"},{"introduced":"fd7b39f3470004fa2574fb750343030c6043826d"},{"fixed":"a42d0ad26c638f7d0a8a52a261a2b9049be1981e"}],"database_specific":{"extracted_events":[{"introduced":"5.7.0-RC1"},{"fixed":"5.7.9"},{"introduced":"5.3.35"},{"fixed":"5.3.48"}],"source":"AFFECTED_FIELD"}}],"versions":["5.7.8","5.7.7","5.3.47","5.7.6","5.7.5","5.3.46","5.7.4","5.7.3","5.3.45","5.7.2","5.7.1","5.7.0","5.7.0-RC4","5.7.0-RC3","5.7.0-RC2","5.7.0-RC1","5.3.44","5.3.43","5.3.42","5.3.41","5.3.40","5.3.39","5.3.38","5.3.37","5.3.36","5.3.35"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57232.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}