CVE-2023-29200

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Apr 25, 2023
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-292019.0XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, CVE-2023-292029.0XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the CVE-2023-292035.3XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally noCVE-2023-292046.1XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measuCVE-2023-292055.4XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proCVE-2023-292065.4XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobCVE-2023-292079.0XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing columCVE-2023-292087.5XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into accounCVE-2023-292098.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible docCVE-2023-29218.8The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to CVE-2023-292108.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible docCVE-2023-292118.8XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` c
CVE-2023-29200: Medium severity, CVSS 6.5 | Vulnix