PT-2025-48077 · Contao · Contao

Published 2025-11-25 · Updated 2025-12-03 · CVE-2025-65960

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contao versions 4.0.0 through 4.13.56 Contao versions 5.3.0 through 5.3.41 Contao versions 5.6.0 through 5.6.4

Description Backend users with control over template closures can execute arbitrary PHP functions without required parameters. The issue involves the ContaoTemplate::once() method.

Recommendations Update to Contao version 4.13.57. Update to Contao version 5.3.42. Update to Contao version 5.6.5. Manually patch the ContaoTemplate::once() method.

Exploit

Fix

RCE

Weakness Enumeration

CWE-351

Related Identifiers

CVE-2025-65960

GHSA-98VJ-MM79-V77R

Affected Products

Contao

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65960.json · Exploit
• https://github.com/contao/contao/security/advisories/GHSA-98vj-mm79-v77r · Vendor Advisory
• https://contao.org/en/security-advisories/remote-code-execution-in-template-closures · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65960 · Security Note
• https://osv.dev/vulnerability/GHSA-98vj-mm79-v77r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65960 · Vendor Advisory
• https://github.com/contao/contao/commit/676f0855d39007ac9a0dbe7ae6a7414cba2312a5 · Note
• https://github.com/contao/contao/commit/577d7fdd5b1ca84f65f034ff556865422f0a3bd1 · Note
• https://github.com/contao/contao · Note
• https://github.com/contao/contao/commit/ebf84c90e5679a67060f396b924ce4a3c3f206b3 · Note
• https://t.me/cveNotify/144634 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1993491498327749067 · Twitter Post
• https://t.me/CVEtracker/38215 · Telegram Post
• https://twitter.com/CVEnew/status/1993397929017491604 · Twitter Post