CVE-2024-28191

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.

• CWE-74
• CWE-74

• https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generatorVendor Advisory
• https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919Patch
• https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016bPatch
• https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8Vendor Advisory
• https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generatorVendor Advisory
• https://github.com/contao/contao/commit/388859dcf110ca70e0fae68a2a5579ab6a702919Patch
• https://github.com/contao/contao/commit/474a2fc25f1d84d786aba8c6d234af99e64d016bPatch
• https://github.com/contao/contao/security/advisories/GHSA-747v-52c4-8vj8Vendor Advisory

Published

Apr 9, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28186FreeScout is an open source help desk and shared inbox built…7.1
• CVE-2024-28187SOY CMS is an open source CMS (content management system) th…7.2
• CVE-2024-28188Jupyter Scheduler is collection of extensions for programmin…5.3
• CVE-2024-28189Judge0 is an open-source online code execution system. The a…10
• CVE-2024-2819Incorrect Default Permissions, Improper Preservation of Perm…6.5
• CVE-2024-28190Contao is an open source content management system. Starting…5.4
• CVE-2024-28192your_spotify is an open source, self hosted Spotify tracking…5.3
• CVE-2024-28193your_spotify is an open source, self hosted Spotify tracking…6.5
• CVE-2024-28194your_spotify is an open source, self hosted Spotify tracking…9.8
• CVE-2024-28195your_spotify is an open source, self hosted Spotify tracking…8.8
• CVE-2024-28196your_spotify is an open source, self hosted Spotify tracking…6.1
• CVE-2024-28197Zitadel is an open source identity management system. Zitade…7.5