Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder beliebigen Code auszuführen.
Product
Contao ist ein Open Source Content Management System zur Erstellung von Websites und Webanwendungen.
Vulnerabilities 2
-
Medium 6.6
Contao is vulnerable to remote code execution in template closures
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issu…
-
Low 3.3
Contao is vulnerable to cross-site scripting in templates
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in vers…
Revision history
-
#1
Initiale Fassung
References
-
Contao Sicherheitshinweis vom 2025-11-25
https://contao.org/de/sicherheitshinweise/cross-site-scripting-in-templates-2
-
GitHub Advisory Database vom 2025-11-25
https://github.com/advisories/GHSA-98vj-mm79-v77r
-
Contao Sicherheitshinweis vom 2025-11-25
https://contao.org/de/sicherheitshinweise/remote-code-execution-in-template-closures-2
-
GitHub Advisory Database vom 2025-11-25
https://github.com/advisories/GHSA-68q5-78xp-cwwc