CVE-2025-57756: Contao discloses sensitive information in the front end search index
Impact
Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search.
Patches
Update to Contao 4.13.56, 5.3.38 or 5.6.1.
Workarounds
Disable the front end search.
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Other sources
Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in versions 4.13.56, 5.3.38, and 5.6.1. A workaround involves disabling the front end search.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57756?
CVE-2025-57756 is classified as a medium severity vulnerability due to the potential exposure of protected content in front end search results.
How do I fix CVE-2025-57756?
To fix CVE-2025-57756, update to Contao version 4.13.56, 5.3.38, or 5.6.1.
What does CVE-2025-57756 affect?
CVE-2025-57756 affects Contao versions prior to 4.13.56, 5.3.38, and 5.6.1.
What is the workaround for CVE-2025-57756?
A temporary workaround for CVE-2025-57756 is to disable the front end search feature.
What type of vulnerability is CVE-2025-57756?
CVE-2025-57756 is an information disclosure vulnerability that exposes protected content in search indexes.