UpHeron
All vulnerabilities

Servers and applications

CVE-2025-57757

Information disclosure in the news module

Severity
Medium 5.3
Published
28 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
5.3.38, 5.6.1
Also known as
GHSA-w53m-gxvg-vx7p
Sources
NVD, Project advisories (GitHub)

Description

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not adding protected news archives to the news feed page.

Affected software

SoftwareAffected versions
ContaoServers and applications · cpe:a:contao:contao
  • From 5.3.0 before 5.3.38
  • From 5.4.0 before 5.6.1
ContaoServers and applications · github:contao/contao
  • From 5.0.0 before 5.3.38

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-57757
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-57757
  • GitHub Advisory Database https://github.com/advisories/GHSA-w53m-gxvg-vx7p
  • github.com https://github.com/contao/contao/security/advisories/GHSA-w53m-gxvg-vx7p