CVE-2022-26265
Critical · 9.8CVSS
9.8
EPSS
30.4%
Published
Mar 18, 2022
CISA due date
—
The record
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | contao/managed-edition | 0 | No fix |
| packagist | contao/core-bundle | 1.5.0 | No fix |
Related vulnerabilities
- GHSA-68q5-78xp-cwwc Contao is vulnerable to cross-site scripting in templates Also affects contao/core-bundle
- GHSA-98vj-mm79-v77r Contao is vulnerable to remote code execution in template closures Also affects contao/core-bundle
- CVE-2025-65961 Contao is vulnerable to cross-site scripting in templates Also affects contao/core-bundle
- CVE-2025-65960 Contao is vulnerable to remote code execution in template closures Also affects contao/core-bundle
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78