{"vulnerability": "CVE-2026-57232", "sightings": [{"uuid": "a2cc0825-e146-4b5a-97a0-3759bf52ead4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57232", "type": "seen", "source": "https://gist.github.com/alon710/3dbcce796ff94299654f0a5d9373d275", "content": "# CVE-2026-57232: CVE-2026-57232: Server-Side Request Forgery in Contao CMS Feed Reader Module\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57232\n\n## Summary\nA Server-Side Request Forgery (SSRF) vulnerability exists in the Contao Open Source Content Management System (CMS) within the Feed Reader front-end module. When processing RSS feed configurations, the module initiates outbound HTTP connections using a default HTTP client that lacks loopback and private network controls. Authenticated backend users with permissions to configure frontend modules can exploit this flaw to coerce the server into sending requests to internal endpoints, loopback addresses, and cloud instance metadata services.\n\n## TL;DR\nAn authenticated backend SSRF vulnerability in the Contao CMS Feed Reader module allows users with module-editing privileges to force the host server to scan or interact with private internal networks and cloud metadata endpoints.\n\n## Technical Details\n\n- **CWE ID**: CWE-918 (Server-Side Request Forgery)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 3.1 (Low)\n- **EPSS Score**: 0.0029 (0.29% percentile: 19.12%)\n- **Impact**: Low Confidentiality (C:L), No Integrity (I:N), No Availability (A:N)\n- **Exploit Status**: No public exploits or weaponized PoCs available\n- **KEV Status**: Not listed in CISA KEV Catalog\n\n## Affected Systems\n\n- Contao Open Source CMS\n- **Contao core-bundle**: >= 5.3.35, <= 5.3.47 (Fixed in: `5.3.48`)\n- **Contao core-bundle**: >= 5.7.0-RC1, <= 5.7.8 (Fixed in: `5.7.9`)\n\n## Mitigation\n\n- Upgrade Contao CMS to version 5.3.48 or 5.7.9 immediately to apply the secure HTTP client decorator.\n- Restrict Contao backend user permissions to prevent unauthorized users from creating or editing Feed Reader modules.\n- Implement network egress filtering rules to restrict the web server from contacting local private subnets and metadata services.\n\n**Remediation Steps:**\n1. Navigate to the root directory of the Contao installation.\n2. Execute `composer update contao/core-bundle` to pull the latest security release.\n3. Verify the installed version of `contao/core-bundle` is either 5.3.48 or 5.7.9 using `composer show contao/core-bundle`.\n4. Clear the application cache by running `php vendor/bin/contao-console cache:clear`.\n5. Restart the PHP-FPM or Apache web server service to apply updates.\n\n## References\n\n- [GHSA-87mg-5grr-rhwh: Server-Side Request Forgery in Contao Feed Reader](https://github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh)\n- [NVD - CVE-2026-57232 Detailed Information](https://nvd.nist.gov/vuln/detail/CVE-2026-57232)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-57232)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57232) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T20:30:32.000000Z"}]}