CVE-2026-57232: Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this->feedIo->read($url) without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services, cloud-provider metadata endpoints, or loopback addresses, causing the server to fetch those resources unconditionally. Confirmed live: the server successfully reaches the internal MySQL database container and its own loopback Apache instance.
References
- contao.org/en/security-advisories/server-side-request-forgery-via-unvalidated-rss-feed-urls
- github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2026-57232.yaml
- github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2026-57232.yaml
- github.com/advisories/GHSA-87mg-5grr-rhwh
- github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f
- github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4
- github.com/contao/contao/releases/tag/5.3.48
- github.com/contao/contao/releases/tag/5.7.9
- github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh
- nvd.nist.gov/vuln/detail/CVE-2026-57232
Code Behaviors & Features
Detect and mitigate CVE-2026-57232 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →