GHSA-98vj-mm79-v77r CVE-2025-65960
Contao is vulnerable to remote code execution in template closures
- Severity
- 6.6 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.19%
- Chance of exploitation in the next 30 days. Higher than 8.71% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-351 Insufficient Type Distinction
- Fix
4.13.57- Upgrade contao/core-bundle to this version or later
Description
Impact
Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.
Patches
Update to Contao 4.13.57, 5.3.42 or 5.6.5
Workarounds
Manually patch the Contao\Template::once() method.
Resources
https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| contao/core-bundle | >= 4.0.0, < 4.13.57 |
4.13.57 |
| contao/core-bundle | >= 5.0.0-RC1, < 5.3.42 |
5.3.42 |
| contao/core-bundle | >= 5.4.0-RC1, < 5.6.5 |
5.6.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
contao/core-bundle Packagist → 4.13.57
- composer
composer require contao/core-bundle:^4.13.57
Severity breakdown
CVSS 3.1 6.6
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-351: Insufficient Type Distinction
The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.
References
Advisories
Packages
Other links
- github.com/contao/contao/security/advisories/GHSA-98vj-mm79-v77r
- github.com/contao/contao/commit/577d7fdd5b1ca84f65f034ff556865422f0a3bd1
- github.com/contao/contao/commit/676f0855d39007ac9a0dbe7ae6a7414cba2312a5
- github.com/contao/contao/commit/ebf84c90e5679a67060f396b924ce4a3c3f206b3
- contao.org/en/security-advisories/remote-code-execution-in-template-closures
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9ff2-p842-45wq Contao: Cross-site request forgery in custom backend actions | Low | Also affects contao/core-bundle |
| GHSA-q6wp-fr43-gm9v Contao: Improper access control in the preview links module | Medium | Also affects contao/core-bundle |
| GHSA-5974-gfqc-wrcm Contao: Improper access control in the table access voter | Medium | Also affects contao/core-bundle |
| GHSA-mrvp-7wmx-5m4h Contao: Path traversal in the images controller | Medium | Also affects contao/core-bundle |
| GHSA-mfxh-vp55-7gc6 Contao: The registration module re-sends activation mails | Medium | Also affects contao/core-bundle |
| GHSA-x2rp-9qf7-2fmq Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled | Medium | Also affects contao/core-bundle |
| GHSA-grm4-wm43-9jh5 Contao: Possible path traversal in job download URIs | Low | Also affects contao/core-bundle |
| GHSA-87mg-5grr-rhwh Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module | Low | Also affects contao/core-bundle |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor