CVE-2026-57232: Contao Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
Summary
CVE-2026-57232: Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module. Affects contao/contao across 2 version ranges.
>= 5.3.35, < 5.3.48
>= 5.4.0, < 5.7.9
Fixed in 5.3.48 or 5.7.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Contao is an open-source content management system (CMS) that enables users to create and manage websites with ease. It offers a range of features including a user-friendly interface, flexible templating, and a modular architecture. The Feed Reader module allows users to aggregate and display content from external RSS feeds. However, this module is vulnerable to a Server-Side Request Forgery (SSRF) attack due to inadequate validation of RSS feed URLs, which can lead to unauthorized access to internal network services.
Vulnerability Detail
The vulnerability arises from the Feed Reader module's handling of RSS feed URLs. The module directly passes user-configured URLs to the HTTP client without validating the scheme or blocking private IP addresses. This allows a backend user with module-edit permissions to configure arbitrary URLs, potentially targeting internal services, cloud metadata endpoints, or loopback addresses. The implications include the ability to enumerate internal services, access unauthenticated APIs, steal cloud metadata credentials, and pivot to internal infrastructure. The vulnerability is classified as CWE-918 (SSRF).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.3.35, < 5.3.485.3.48composer require contao/contao:5.3.48 -
>= 5.4.0, < 5.7.95.7.9composer require contao/contao:5.7.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict backend user permissions to prevent unauthorized access to the Feed Reader module until the patch is applied. Additionally, consider implementing network-level controls to block access to internal services from the web server.
Conclusion
CVE-2026-57232 is a critical SSRF vulnerability in the Contao CMS that can lead to significant security risks. It is essential to update to the latest patched versions and implement recommended security measures to protect your application from potential exploitation.
See every vulnerability recorded for contao/contao →
FAQ
CVE-2026-57232 is a vulnerability in the Contao CMS that allows for Server-Side Request Forgery (SSRF) through unvalidated RSS feed URLs in the Feed Reader module.
An attacker with backend module-edit permissions can configure arbitrary URLs, potentially accessing internal services or cloud metadata endpoints.
The impacts include unauthorized access to internal APIs, enumeration of internal services, and the ability to steal sensitive cloud metadata credentials.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If immediate updates are not possible, restrict backend user permissions and implement network-level controls to mitigate the risk until a patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/contao.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
