Servers and applications
CVE-2026-107845
Cross-site scripting in the comments bundle
- Severity
- Critical 9.3
- Published
- 25 Aug 2026
- Last changed
- 9 Oct 2026
- Added to UpHeron
- 3 Nov 2026
- Fixed in
- 5.3.50, 5.7.12
- Also known as
- GHSA-628f-v4f6-p37r
- Sources
- CVE Program, Project advisories (GitHub)
Description
Contao: Cross-site scripting in the comments bundle
Affected software
| Software | Affected versions |
|---|---|
ContaoServers and applications · cna:contao|contao |
|
ContaoServers and applications · github:contao/contao |
|
References
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-107845
- GitHub Advisory Database https://github.com/advisories/GHSA-628f-v4f6-p37r
- github.com https://github.com/contao/contao/security/advisories/GHSA-628f-v4f6-p37r