CVEvulnerability

CVE-2025-65960

6.6 MEDIUM Published 2025-11-25 Modified 2026-10-18 Official page ↗
Status
Analyzed
Published
2025-11-25
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.6 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-351

Description

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.

Affected configurations

• contao contao (>= 4.0.0 < 4.13.57) • contao contao (>= 5.0.0 < 5.3.42) • contao contao (>= 5.4.0 < 5.6.5)

Related

Weakness · CWE (1)

  • CWE-351 Insufficient Type Distinction weakness

References