GitHub Advisoryadvisory · Packagist

GHSA-w53m-gxvg-vx7p Contao can disclose sensitive information in the news module

MEDIUM Published 2025-08-28 Modified 2025-08-28 Official page ↗
Aliases
CVE-2025-57757
Ecosystem
Packagist
Packages
contao/core-bundle, contao/contao
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-212
Reviewed
2025-08-28

Affected packages

• Packagist contao/core-bundle: >= 5.0.0-RC1, < 5.3.38 → fixed in 5.3.38 • Packagist contao/core-bundle: >= 5.4.0-RC1, < 5.6.1 → fixed in 5.6.1 • Packagist contao/contao: >= 5.0.0-RC1, < 5.3.38 → fixed in 5.3.38 • Packagist contao/contao: >= 5.4.0-RC1, < 5.6.1 → fixed in 5.6.1

Description

Impact If a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. Patches Update to Contao 5.3.38 or 5.6.1. Workarounds Do not add protected news archives to the news feed page. For more information If you have any questions or comments about this advisory, open an issue in contao/contao.

Related

Alias · CVE (1)

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness

References