CVE-2025-65961: Contao is vulnerable to cross-site scripting in templates
Impact
It is possible to inject code into the template output that will be executed in the browser in the front end and back end.
Patches
Update to Contao 4.13.57, 5.3.42 or 5.6.5.
Workarounds
Do not use the affected templates or patch them manually.
Refsources
https://contao.org/en/security-advisories/cross-site-scripting-in-templates
Other sources
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65961?
CVE-2025-65961 has a high severity due to the potential for code injection in both front-end and back-end templates.
How do I fix CVE-2025-65961?
To fix CVE-2025-65961, upgrade your Contao installation to version 4.13.57, 5.3.42, or 5.6.5 or later.
What versions of Contao are affected by CVE-2025-65961?
Contao versions from 4.0.0 to 4.13.56, and versions before 5.3.42 and 5.6.5 are affected by CVE-2025-65961.
What type of vulnerability is CVE-2025-65961?
CVE-2025-65961 is a code injection vulnerability that allows attacker's scripts to run in the browser.
Is CVE-2025-65961 exploited in the wild?
As of now, there have been no specific reports of CVE-2025-65961 being exploited in the wild, but it is essential to apply patches promptly.