PT-2025-11638 · Contao · Contao

Published 2025-03-18 · Updated 2025-03-18 · CVE-2025-29790

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contao versions prior to 4.13.54 Contao versions prior to 5.3.30 Contao versions prior to 5.5.6

Description The issue allows users to upload SVG files containing malicious code, which is then executed in the back end and/or front end.

Recommendations Update to Contao 4.13.54 or later. Update to Contao 5.3.30 or later. Update to Contao 5.5.6 or later. As a temporary workaround, consider removing svg,svgz from the allowed upload file types in the system settings and from contao.editable files in the config.yaml.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-29790

GHSA-VQQR-FGMH-F626

Affected Products

Contao

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29790.json · Exploit
• https://github.com/contao/contao/security/advisories/GHSA-vqqr-fgmh-f626 · Patch
• https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29790 · Security Note
• https://osv.dev/vulnerability/GHSA-vqqr-fgmh-f626 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29790 · Vendor Advisory
• https://github.com/contao/contao · Note
• https://t.me/cvedetector/20603 · Telegram Post
• https://twitter.com/CVEnew/status/1902071495016509765 · Twitter Post
• https://t.me/cvetracker/19400 · Telegram Post