GHSA-68q5-78xp-cwwc
Low · 3.3CVSS
3.3
EPSS
—
Published
Nov 25, 2025
CISA due date
—
The record
Contao is vulnerable to cross-site scripting in templates
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | contao/core-bundle | 4.0.0 | 4.13.57 |
| Packagist | contao/core-bundle | 5.0.0-RC1 | 5.3.42 |
| Packagist | contao/core-bundle | 5.4.0-RC1 | 5.6.5 |
| packagist | contao/core-bundle | 4.0.0 | 4.13.57 |
| packagist | contao/core-bundle | 5.0.0-RC1 | 5.3.42 |
| packagist | contao/core-bundle | 5.4.0-RC1 | 5.6.5 |
Related vulnerabilities
- CVE-2025-65961 Contao is vulnerable to cross-site scripting in templates Same vulnerability
- GHSA-98vj-mm79-v77r Contao is vulnerable to remote code execution in template closures Also affects contao/core-bundle
- CVE-2025-65960 Contao is vulnerable to remote code execution in template closures Also affects contao/core-bundle
- CVE-2022-26265 Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE)… Also affects contao/core-bundle
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79