CVE-2024-45604

Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

• CWE-22

• https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widgetVendor Advisory
• https://github.com/contao/contao/security/advisories/GHSA-4p75-5p53-65m9Third Party Advisory

Published

Sep 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45597Pluto is a superset of Lua 5.4 with a focus on general-purpo…5.3
• CVE-2024-45598Cacti is an open source performance and fault management fra…4.9
• CVE-2024-45599Cursor is an artificial intelligence code editor. Prior to v…3.8
• CVE-2024-4560The Kognetiks Chatbot for WordPress plugin for WordPress is …9.8
• CVE-2024-45600Fields is a GLPI plugin that allows users to add custom fiel…7.7
• CVE-2024-45601Mesop is a Python-based UI framework designed for rapid web …7.5
• CVE-2024-45605Sentry is a developer-first error tracking and performance m…4.3
• CVE-2024-45606Sentry is a developer-first error tracking and performance m…4.3
• CVE-2024-45607whatsapp-api-js is a TypeScript server agnostic Whatsapp's O…5.3
• CVE-2024-45608GLPI is a free asset and IT management software package. An …8.8
• CVE-2024-45609GLPI is a Free Asset and IT Management Software package, Dat…6.1
• CVE-2024-4561 In WhatsUp Gold versions released before 2023.1.2 , a bli…5.3