Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5....

参照URL

• advisory contao.org
• advisory github.com
• advisory nvd.nist.gov
• web grimthereaperteam.medium.com