PT-2025-48078 · Contao · Contao

Published 2025-11-25 · Updated 2025-12-01 · CVE-2025-65961

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contao versions 4.0.0 through 4.13.56 Contao versions 5.3.0 through 5.3.41 Contao versions 5.6.0 through 5.6.4

Description Contao is susceptible to code injection within template output, potentially leading to code execution in both the front end and back end of the application. The issue allows for the injection of malicious code that is then executed by the user's browser.

Recommendations Update to Contao version 4.13.57 Update to Contao version 5.3.42 Update to Contao version 5.6.5 As a workaround, avoid using the affected templates As a workaround, manually patch the affected templates

Exploit

Fix

XSS

Weakness Enumeration

CWE-87

CWE-79

Related Identifiers

CVE-2025-65961

GHSA-68Q5-78XP-CWWC

Affected Products

Contao

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65961.json · Exploit
• https://github.com/contao/contao/security/advisories/GHSA-68q5-78xp-cwwc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68q5-78xp-cwwc · Vendor Advisory
• https://contao.org/en/security-advisories/cross-site-scripting-in-templates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65961 · Security Note
• https://github.com/contao/contao · Note
• https://reddit.com/r/VulnMatter/comments/1pbe9h1/resumen_diario_de_vulnerabilidades_01122025 · Reddit Post
• https://t.me/CVEtracker/38217 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1p9dokj/resumen_diario_de_vulnerabilidades_29112025 · Reddit Post
• https://twitter.com/CVEnew/status/1993401919646450160 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p9ah42/resumen_diario_de_vulnerabilidades_29112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1p8bkgw/resumen_diario_de_vulnerabilidades_27112025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1993488938586010043 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p8bkku/resumen_diario_de_vulnerabilidades_27112025 · Reddit Post