CVE-2026-57232: Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this->feedIo->read($url) without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services, cloud-provider metadata endpoints, or loopback addresses, causing the server to fetch those resources unconditionally. Confirmed live: the server successfully reaches the internal MySQL database container and its own loopback Apache instance.
References
- contao.org/en/security-advisories/server-side-request-forgery-via-unvalidated-rss-feed-urls
- github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2026-57232.yaml
- github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2026-57232.yaml
- github.com/advisories/GHSA-87mg-5grr-rhwh
- github.com/contao/contao/commit/27f6201809553bee767dcef15535bb8f0f4eac5f
- github.com/contao/contao/commit/53b939ff2c4718e3a1d7c54ddd8886e9370618e4
- github.com/contao/contao/releases/tag/5.3.48
- github.com/contao/contao/releases/tag/5.7.9
- github.com/contao/contao/security/advisories/GHSA-87mg-5grr-rhwh
- nvd.nist.gov/vuln/detail/CVE-2026-57232
Code Behaviors & Features
Detect and mitigate CVE-2026-57232 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →