Most recent entries from all

EUVD-2026-261889

fkie_cve-2025-65960

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.

GHSA-98vj-mm79-v77r — Contao is vulnerable to remote code execution in template closures

Affected: Packagist: contao/core-bundle

### Impact

Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.

### Patches

Update to Contao 4.13.57, 5.3.42 or 5.6.5

### Workarounds

Manually patch the `Contao\Template::once()` method.

### Resources

https://contao.org/en/security-advisories/remote-code-execution-in-template-closures

WID-SEC-W-2025-2679 — Contao: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder beliebigen Code auszuführen.