GitHub Advisoryadvisory · Packagist

GHSA-68q5-78xp-cwwc Contao is vulnerable to cross-site scripting in templates

LOW Published 2025-11-25 Modified 2025-11-27 Official page ↗
Aliases
CVE-2025-65961
Ecosystem
Packagist
Packages
contao/core-bundle
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-79, CWE-87
Reviewed
2025-11-25

Affected packages

• Packagist contao/core-bundle: >= 4.0.0, < 4.13.57 → fixed in 4.13.57 • Packagist contao/core-bundle: >= 5.0.0-RC1, < 5.3.42 → fixed in 5.3.42 • Packagist contao/core-bundle: >= 5.4.0-RC1, < 5.6.5 → fixed in 5.6.5

Description

Impact It is possible to inject code into the template output that will be executed in the browser in the front end and back end. Patches Update to Contao 4.13.57, 5.3.42 or 5.6.5. Workarounds Do not use the affected templates or patch them manually. Refsources https://contao.org/en/security-advisories/cross-site-scripting-in-templates

Related

Alias · CVE (1)

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-87 Improper Neutralization of Alternate XSS Syntax weakness

References