Contao is vulnerable to cross-site scripting in templates

Vulnerability

CVE-2025-65961 is a cross-site scripting (XSS) vulnerability in the Contao Open Source CMS that allows an attacker to inject arbitrary JavaScript code into template output. The issue affects all versions from 4.0.0 up to, but not including, 4.13.57, 5.3.42, and 5.6.5 [1] [3] [4]. The root cause lies in insufficient sanitization of user-controllable data within template rendering, enabling the injection of malicious script that is then executed in the browser context of legitimate users. This is a classic template injection vulnerability that compromises the integrity of the page output.

Exploitation

The attacker does not require authentication for exploitation in some scenarios, as the injection point may be accessible to unauthenticated users on the frontend. The attack vector is remote, and the complexity is low, requiring the attacker to craft a malicious input that is processed by an affected template [3]. User interaction is not necessarily required; if the attacker can inject the payload into a stored template or a publicly accessible page, any user viewing that page becomes a victim. The scope of the attack can change, as the injected script can access and modify resources beyond the vulnerable component, potentially affecting the entire CMS instance [3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user viewing the compromised page, both in the frontend and the backend [1] [4]. This can lead to session hijacking, credential theft, defacement of the site, or further attacks against administrators and visitors. The impacts on confidentiality, integrity, and availability are rated high, as the attacker can read sensitive data, modify page content, and disrupt normal operations [3].

Mitigation

The vulnerability has been patched in Contao versions 4.13.57, 5.3.42, and 5.6.5 [1] [4]. Users should upgrade immediately to one of these versions. The official workaround is to avoid using the affected templates entirely or to apply manual patches to the template files [4]. There is no indication that this vulnerability is currently listed in the Known Exploited Vulnerabilities catalog, but given its severity and ease of exploitation, prompt remediation is strongly advised.