Contao allows cross-site scripting through SVG uploads

Vulnerability

Overview

CVE-2025-29790 is a cross-site scripting (XSS) vulnerability in the Contao Open Source CMS. The application fails to sanitize SVG files uploaded by users, allowing attackers to embed arbitrary JavaScript or other malicious code within SVG markup. When the SVG is rendered in the back end or front end, the injected code executes in the context of the victim's browser [1][3].

Exploitation

Prerequisites

An attacker must have the ability to upload files to a Contao instance—typically an authenticated user with file upload permissions. No special network position is required; the attack is carried out through the standard file upload functionality. The malicious SVG is stored on the server and served to other users, including administrators, when they view the file in the CMS interface [3][4].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browsers of users who view the uploaded SVG. This can lead to session hijacking, defacement, theft of sensitive data, or further actions within the CMS as the victim user. The vulnerability affects both the administrative back end and the public front end [1][4].

Mitigation

The vulnerability is fixed in Contao versions 4.13.54, 5.3.30, and 5.5.6. As a workaround, administrators can remove svg and svgz from the allowed upload file types in the system settings and from the contao.editable_files configuration in config.yaml [3][4].