Skip to content
OpenAdvisories
Medium WID-SEC-2025-1920 4 CVEs

Contao: Mehrere Schwachstellen

Published Aug 27, 2025 · Updated Aug 28, 2025 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

Product

Contao ist ein Open Source Content Management System zur Erstellung von Websites und Webanwendungen.

Vulnerabilities 4

  • Medium 5.3
    CVE-2025-57756

    Contao discloses sensitive information in the front end search index

    Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in…

    contao contao contao/core-bundle contao/contao Packagist
  • Medium 5.3
    CVE-2025-57757

    Contao discloses information in the news module

    Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versi…

    contao contao contao/core-bundle contao/contao Packagist
  • Medium 4.3
    CVE-2025-57758

    Contao has improper access control in the back end voters

    Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1…

    contao contao contao/core-bundle contao/contao Packagist
  • Medium 4.3
    CVE-2025-57759

    Contao has improper privilege management for page and article fields

    Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in ver…

    contao contao contao/core-bundle contao/contao Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-26127, EUVD-2025-26125, EUVD-2025-26126, EUVD-2025-26124

  2. #1

    Initiale Fassung

References