CVE-2025-65961
Low · 3.3Contao is vulnerable to cross-site scripting in templates
CVSS
3.3
EPSS
0.2%
Published
Nov 25, 2025
CISA due date
—
The record
It is possible to inject code into the template output that will be executed in the browser in the front end and back end.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | contao/core-bundle | 4.0.0 | 4.13.57 |
| Packagist | contao/core-bundle | 5.0.0-RC1 | 5.3.42 |
| Packagist | contao/core-bundle | 5.4.0-RC1 | 5.6.5 |
| packagist | contao/core-bundle | 4.0.0 | 4.13.57 |
| packagist | contao/core-bundle | 5.0.0-RC1 | 5.3.42 |
| packagist | contao/core-bundle | 5.4.0-RC1 | 5.6.5 |
Related vulnerabilities
- GHSA-68q5-78xp-cwwc Contao is vulnerable to cross-site scripting in templates Same vulnerability
- GHSA-98vj-mm79-v77r Contao is vulnerable to remote code execution in template closures Also affects contao/core-bundle
- CVE-2025-65960 Contao is vulnerable to remote code execution in template closures Also affects contao/core-bundle
- CVE-2022-26265 Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE)… Also affects contao/core-bundle
- CVE-2026-54002 Kirby is an open-source content management system. CWE-87
- CVE-2026-55661 Tina is a headless content management system. CWE-87
- GHSA-2vcc-5v34-9jc8 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing… CWE-87
- CVE-2026-46492 md-fileserver allows for local viewing of markdown files in a browser. CWE-87