~ / search / GHSA-68q5-78xp-cwwc

GHSA-68q5-78xp-cwwc

Contao is vulnerable to cross-site scripting in templates

Source: GitHub Advisory Database (reviewed) Low CVE-2025-65961

Packages

EcosystemPackageAffectedFixed in
Packagist contao/core-bundle >= 4.0.0, < 4.13.57 4.13.57
Packagist contao/core-bundle >= 5.0.0-RC1, < 5.3.42 5.3.42
Packagist contao/core-bundle >= 5.4.0-RC1, < 5.6.5 5.6.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact It is possible to inject code into the template output that will be executed in the browser in the front end and back end. ### Patches Update to Contao 4.13.57, 5.3.42 or 5.6.5. ### Workarounds Do not use the affected templates or patch them manually. ### Refsources https://contao.org/en/security-advisories/cross-site-scripting-in-templates

References

External links from the advisory. They lead to third-party sites.