CVE-2025-65960
Medium · 6.6Contao is vulnerable to remote code execution in template closures
CVSS
6.6
EPSS
0.2%
Published
Nov 25, 2025
CISA due date
—
The record
Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | contao/core-bundle | 4.0.0 | 4.13.57 |
| Packagist | contao/core-bundle | 5.0.0-RC1 | 5.3.42 |
| Packagist | contao/core-bundle | 5.4.0-RC1 | 5.6.5 |
| packagist | contao/core-bundle | 4.0.0 | 4.13.57 |
| packagist | contao/core-bundle | 5.0.0-RC1 | 5.3.42 |
| packagist | contao/core-bundle | 5.4.0-RC1 | 5.6.5 |
Related vulnerabilities
- GHSA-98vj-mm79-v77r Contao is vulnerable to remote code execution in template closures Same vulnerability
- GHSA-68q5-78xp-cwwc Contao is vulnerable to cross-site scripting in templates Also affects contao/core-bundle
- CVE-2025-65961 Contao is vulnerable to cross-site scripting in templates Also affects contao/core-bundle
- CVE-2022-26265 Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE)… Also affects contao/core-bundle
- CVE-2026-15305 Users were able to upload files with arbitrary MIME types to forms using FileUpload or… CWE-351
- CVE-2025-31951 HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command… CWE-351
- GHSA-pr66-whqj-rq5p Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as… CWE-351
- CVE-2026-41341 OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing… CWE-351