https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T06:24:45.496414+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-261889 EUVD-2026-261889 2026-10-05T06:24:45.500585+00:00 EUVD-2026-261889 https://cve.radiocsirt.org/vuln/fkie_cve-2025-65960 fkie_cve-2025-65960 2026-10-05T06:24:45.500627+00:00

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.

 https://cve.radiocsirt.org/vuln/ghsa-98vj-mm79-v77r GHSA-98vj-mm79-v77r — Contao is vulnerable to remote code execution in template closures 2026-10-05T06:24:45.500675+00:00

Affected: Packagist: contao/core-bundle

### Impact

Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.

### Patches

Update to Contao 4.13.57, 5.3.42 or 5.6.5

### Workarounds

Manually patch the `Contao\Template::once()` method.

### Resources

https://contao.org/en/security-advisories/remote-code-execution-in-template-closures

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2679 WID-SEC-W-2025-2679 — Contao: Mehrere Schwachstellen 2026-10-05T06:24:45.500724+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder beliebigen Code auszuführen.