contao/core (packagist) has 9 known vulnerabilities, the worst rated CRITICAL. Upgrade to 3.5.39 or later to clear all of them. No malicious-package signal is recorded.
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation.
CyberXYZ does not call a package safe in absolute terms. It records 9 known vulnerabilities for contao/core (packagist), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does contao/core have known vulnerabilities?
Yes. CyberXYZ records 9 known vulnerabilities for contao/core (packagist), the worst rated CRITICAL. These include GHSA-wxxw-5gq6-j2g5, GHSA-vcgg-hp4r-87gx, GHSA-wq43-8r5p-w3mc, GHSA-x5g4-crxq-qxjx, GHSA-9jq2-jvwc-p52f.
Which version of contao/core should I use?
3.5.39 or later clears every advisory recorded for contao/core (packagist). Check the release you pick before installing it.
How do I check contao/core before installing?
Search contao/core in CyberXYZ Check at https://cyberxyz.io/check?q=contao%2Fcore. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 10:26 UTC. The most recent advisory here was published 2024-05-15. Updated continuously from NVD, GHSA, OSV and CNA feeds.