The vulnerability is a server‑side request forgery in the Contao Feed Reader module. Because no URL scheme or private‑address validation is performed, a user who can edit the module can supply arbitrary RSS feed URLs. When the server processes these URLs, it forwards the request to any internal, loopback, or cloud metadata endpoint, thereby exposing internal resources or sensitive information. The weakness is CWE‑918 and its impact is limited to confidentiality exposure of internal services; it does not allow arbitrary code execution or denial‑of‑service.

Contao CMS (contao:contao) version 5.3.35 through 5.3.47 and 5.7.0‑RC1 through 5.7.8 are affected. All other versions are considered safe.

The CVSS score of 3.1 indicates low severity. The EPSS score is less than 1 %, showing a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a backend user with module‑edit permissions and a functional Feed Reader module; an attacker with those privileges can direct the server to any internal URL via the unvalidated RSS feed field. The lack of private‑network checks results in the ability to reach internal addresses.