UpHeron
All vulnerabilities

Servers and applications

CVE-2025-65961

Cross-site scripting in templates

Severity
Medium 4.8
Published
25 Nov 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.13.57, 5.3.42, 5.6.5
Also known as
GHSA-68q5-78xp-cwwc
Sources
NVD, Project advisories (GitHub)

Description

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.

Affected software

SoftwareAffected versions
ContaoServers and applications · cpe:a:contao:contao
  • From 4.0.0 before 4.13.57
  • From 5.0.0 before 5.3.42
  • From 5.4.0 before 5.6.5
ContaoServers and applications · github:contao/contao
  • From 4.0.0 before 4.13.57

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-65961
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-65961
  • GitHub Advisory Database https://github.com/advisories/GHSA-68q5-78xp-cwwc
  • github.com https://github.com/contao/contao/security/advisories/GHSA-68q5-78xp-cwwc