Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Low · CVSS 3.1

### Summary The Feed Reader front-end module passes RSS feed URLs from its configuration directly to `$this->feedIo->read($url)` without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services, cloud-provider metadata endpoints, or loopback addresses, causing the server to fetch those resources unconditionally. Confirmed live: the server successfully reaches the internal MySQL database container and its own loopback Apache instance.

Remediation

Upgrade contao/contao to 5.3.48 or later. Upgrade contao/contao to 5.7.9 or later. Upgrade contao/core-bundle to 5.3.48 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-87mg-5grr-rhwh

← All threats