CVE-2025-65961

LowCVSS 3.3

Published: 25/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Contao is an open source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into template output that will be executed in the browser in the front end and back end. The issue is patched in versions 4.13.57, 5.3.42, and 5.6.5.

Risk Assessment

An attacker could inject malicious code executed in users' browsers (XSS), potentially leading to session or data theft.

Recommendation

Update Contao to version 4.13.57, 5.3.42, or 5.6.5 (or later). If updating is not possible, avoid using affected templates or patch them manually.

Other vulnerabilities in Contao CMS

CVE-2023-36806Medium
Contao is an open source content management system. In versions from 4.0.0 to 4.9.42, 4.13.28, and 5.1.10, untrusted backend users can inject malicious code into headline fields, which will be executed both in the element preview and on the website.

Original NVD description (English source)

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS