high8.8
CVE-2019-19745
Contao 4.0 through 4.8.5 allows PHP local file inclusion.
Impact
Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Contao | Contao | from 4.4 through 4.4.45 from 4.8 through 4.8.5 Versions 4.0, 4.1, 4.2, 4.3 |