Security advisories
Here you will find a list of vulnerabilities that have already been found and fixed in Contao. If you think that you have found a security issue in Contao, please report it according to our security policy.
2025
by Leo Feyer
Cross-site scripting in templates
Date
25.11.2025
CVE ID
CVE-2025-65961
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.13.57, 5.3.42, 5.6.5
Security advisory
by Leo Feyer
Remote code execution in template closures
Date
25.11.2025
CVE ID
CVE-2025-65960
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.13.57, 5.3.42, 5.6.5
Security advisory
by Leo Feyer
Information disclosure in the front end search index
Date
28.08.2025
CVE ID
CVE-2025-57756
Package
contao/core-bundle
Affected versions
>=4.9.14
Patched versions
4.13.56, 5.3.38, 5.6.1
Security advisory
by Leo Feyer
Information disclosure in the news module
Date
28.08.2025
CVE ID
CVE-2025-57757
Package
contao/news-bundle
Affected versions
>=5.0.0
Patched versions
5.3.38, 5.6.1
Security advisory
by Leo Feyer
Improper access control in the back end voters
Date
27.08.2025
CVE ID
CVE-2025-57758
Package
contao/core-bundle
Affected versions
>=5.0.0
Patched versions
5.3.38, 5.6.1
Security advisory
by Leo Feyer
Improper privilege management for page and article fields
Date
28.08.2025
CVE ID
CVE-2025-57759
Package
contao/core-bundle
Affected versions
>=5.3.0
Patched versions
5.3.38, 5.6.1
Security advisory
by Leo Feyer
Cross-site scripting through SVG uploads
Date
18.03.2025
CVE ID
CVE-2025-29790
Package
contao/core-bundle
Affected versions
>=4.0.0
Patched versions
4.13.54, 5.3.30, 5.5.6
Security advisory