GitHub Advisoryadvisory · Packagist
GHSA-98vj-mm79-v77r Contao is vulnerable to remote code execution in template closures
MEDIUM
Official page ↗
- Aliases
- CVE-2025-65960
- Ecosystem
- Packagist
- Packages
- contao/core-bundle
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-351
- Reviewed
- 2025-11-25
Affected packages
• Packagist contao/core-bundle: >= 4.0.0, < 4.13.57 → fixed in 4.13.57
• Packagist contao/core-bundle: >= 5.0.0-RC1, < 5.3.42 → fixed in 5.3.42
• Packagist contao/core-bundle: >= 5.4.0-RC1, < 5.6.5 → fixed in 5.6.5
Description
Impact
Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.
Patches
Update to Contao 4.13.57, 5.3.42 or 5.6.5
Workarounds
Manually patch the `Contao\Template::once()` method.
Resources
https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
Related
Alias · CVE (1)
- CVE-2025-65960 Contao is an Open Source CMS. vulnerability
Weakness · CWE (1)
- CWE-351 Insufficient Type Distinction weakness
References
- https://github.com/contao/contao/security/advisories/GHSA-98vj-mm79-v77r web
- https://nvd.nist.gov/vuln/detail/CVE-2025-65960 advisory
- https://github.com/contao/contao/commit/577d7fdd5b1ca84f65f034ff556865422f0a3bd1 web
- https://github.com/contao/contao/commit/676f0855d39007ac9a0dbe7ae6a7414cba2312a5 web
- https://github.com/contao/contao/commit/ebf84c90e5679a67060f396b924ce4a3c3f206b3 web
- https://contao.org/en/security-advisories/remote-code-execution-in-template-closures web
- https://github.com/contao/contao package