CVE-2025-65961

LOW3.3EPSS 0.02%

Contao is vulnerable to cross-site scripting in templates

Published: 11/25/2025Modified: 12/3/2025

Description

### Impact It is possible to inject code into the template output that will be executed in the browser in the front end and back end. ### Patches Update to Contao 4.13.57, 5.3.42 or 5.6.5. ### Workarounds Do not use the affected templates or patch them manually. ### Refsources https://contao.org/en/security-advisories/cross-site-scripting-in-templates

Affected packages (1)

Packagist/contao/core-bundle>= 4.0.0, < 4.13.57

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	LOW3.3	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-65961
PATCHhttps://github.com/contao/contao
WEBhttps://contao.org/en/security-advisories/cross-site-scripting-in-templates
WEBhttps://github.com/contao/contao/security/advisories/GHSA-68q5-78xp-cwwc