low3.3
CVE-2025-65961
Contao is vulnerable to cross-site scripting in templates
Impact
### Impact It is possible to inject code into the template output that will be executed in the browser in the front end and back end. ### Patches Update to Contao 4.13.57, 5.3.42 or 5.6.5. ### Workarounds Do not use the affected templates or patch them manually. ### Refsources https://contao.org/en/security-advisories/cross-site-scripting-in-templates
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | contao/core-bundle | >= 4.0.0, < 4.13.57 | 4.13.57 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Contao | Contao | from 4.0.0 before 4.13.57 from 5.0.0 before 5.3.42 from 5.4.0 before 5.6.5 |