SecuriTricks - CVE-2025-65961

Description

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.

Product(s) Impacted

Vendor	Product	Versions
Contao	Contao	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CWE-87

Improper Neutralization of Alternate XSS Syntax

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	contao	contao	/	/	/	/	/	/	/	/
a	contao	contao	/	/	/	/	/	/	/	/
a	contao	contao	/	/	/	/	/	/	/	/

References

https://contao.org/en/security-advisories/cross-site-scripting-in-templates

https://github.com/contao/contao/security/advisories/GHSA-68q5-78xp-cwwc

CVSS Score

3.3 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: HIGH
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

View Vector String

Timeline

Published: Nov. 25, 2025, 7:15 p.m.
Last Modified: Dec. 3, 2025, 6:20 p.m.

Status : Analyzed

CVE has had analysis completed and all data associations made.

More info

Source

security-advisories@github.com

CVE-2025-65961