TangoCMS Security Advisories and Known Vulnerabilities
Important: TangoCMS has not received updates since 2010 and the project ended in 2013. Every installation, including the last version 2.6.1, should be considered unmaintained. If you still run TangoCMS, plan a migration.
You may have arrived here from a vulnerability database. Those entries link to the project’s old changelog, release announcements and issue tracker (tangocms.org/changelog, /article/view/…, dev.tangocms.org/issues/…). The original pages no longer exist; this page summarises what they documented.
Public CVE entries
| CVE | Summary | Affected | Fixed in |
|---|---|---|---|
| CVE-2008-6048 | Multiple cross-site request forgery (CSRF) vulnerabilities that could let attackers act with an administrator’s session | before 2.2.0 | 2.2.0 “Eagle” |
| CVE-2009-0862 | Cross-site scripting (XSS) in the error output of the admin area | 2.2.x before 2.2.4 | 2.2.4 |
| CVE-2009-2376 | Cross-site scripting (XSS) in the internal HTML library (textarea handling); project bug report “Security #140” | 2.x before 2.3.0 | 2.3.0 “Dolphin” |
Advisories published by the project (TSA)
The project published its own TangoCMS Security Announcements:
| Advisory | Date | Summary | Affected |
|---|---|---|---|
| TSA 2008-10/1 | 18 Oct 2008 | Missing permission check allowed users to vote on any poll | up to 2.1.0 |
| TSA 2008-12/1 | 18 Dec 2008 | See the archived advisory | – |
| TSA 2009-02/1 | 20 Feb 2009 | See the archived advisory | – |
| TSA 2009-06/1 | 29 Jun 2009 | XSS in the internal HTML library (Security #140, CVE-2009-2376) | before 2.3.0 |
| TSA 2009-12/1 | 14 Dec 2009 | Uploaded media files could be reached directly by URL, bypassing access checks | before 2.4.0 |
| TSA 2010-03/1 | Mar 2010 | File upload filter bypass that could allow uploading and running a PHP script (Security #237) | up to 2.5.0 |
Summaries are based on the project’s archived advisories and the National Vulnerability Database. For exact technical details, follow the links.
What this means today
Even the fixed versions are more than fifteen years old and were written for PHP versions that no longer receive security updates. Running TangoCMS on a public server today is not advisable. See Migrating away from TangoCMS for practical steps.
This site has no access to the old issue tracker and cannot provide patches.