UpHeron
All vulnerabilities

Servers and applications

CVE-2025-65960

Remote code execution in template closures

Severity
Medium 6.6
Published
25 Nov 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.13.57, 5.3.42, 5.6.5
Also known as
GHSA-98vj-mm79-v77r
Sources
NVD, Project advisories (GitHub)

Description

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the…

Affected software

SoftwareAffected versions
ContaoServers and applications · cpe:a:contao:contao
  • From 4.0.0 before 4.13.57
  • From 5.0.0 before 5.3.42
  • From 5.4.0 before 5.6.5
ContaoServers and applications · github:contao/contao
  • From 4.0.0 before 4.13.57

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-65960
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-65960
  • GitHub Advisory Database https://github.com/advisories/GHSA-98vj-mm79-v77r
  • github.com https://github.com/contao/contao/security/advisories/GHSA-98vj-mm79-v77r