Description
Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.
Remediation
References
Related Vulnerabilities
Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2009-3946)
Drupal Core 6.x Multiple Vulnerabilities (6.0 - 6.12)
MySQL CVE-2024-20965 Vulnerability (CVE-2024-20965)
WordPress Plugin WP Media Cleaner Multiple Cross-Site Scripting Vulnerabilities (2.2.6)
WordPress Plugin Conditional Payments for WooCommerce Cross-Site Request Forgery (2.3.1)