GitHub Advisoryadvisory · Packagist

GHSA-2xmj-8wmq-7475 Contao discloses sensitive information in the front end search index

MEDIUM Published 2025-08-28 Modified 2025-08-28 Official page ↗
Aliases
CVE-2025-57756
Ecosystem
Packagist
Packages
contao/core-bundle, contao/contao
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-612
Reviewed
2025-08-28

Affected packages

• Packagist contao/core-bundle: >= 4.9.14, < 4.13.56 → fixed in 4.13.56 • Packagist contao/contao: >= 4.9.14, < 4.13.56 → fixed in 4.13.56 • Packagist contao/core-bundle: >= 5.0.0-RC1, < 5.3.38 → fixed in 5.3.38 • Packagist contao/core-bundle: >= 5.4.0-RC1, < 5.6.1 → fixed in 5.6.1 • Packagist contao/contao: >= 5.0.0-RC1, < 5.3.38 → fixed in 5.3.38 • Packagist contao/contao: >= 5.4.0-RC1, < 5.6.1 → fixed in 5.6.1

Description

Impact Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. Patches Update to Contao 4.13.56, 5.3.38 or 5.6.1. Workarounds Disable the front end search. For more information If you have any questions or comments about this advisory, open an issue in contao/contao.

Related

Alias · CVE (1)

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-612 Improper Authorization of Index Containing Sensitive Information weakness

References