CVE-2025-65960 - CVE House
Back to Database
Status published Medium CVE-2025-65960

Contao is vulnerable to remote code execution in template closures

Vulnerability Description

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65960

Credits & Attribution

No credits recorded in the NVD database.

References

More from contao

View All →
CVE-2025-65961
Contao is vulnerable to cross-site scripting in templates
Low 3.3
CVE-2025-57759
Contao has improper privilege management for page and article fields
Medium 4.3
CVE-2025-57758
Contao has improper access control in the back end voters
Medium 4.3
CVE-2025-57757
Contao discloses information in the news module
Medium 5.3
CVE-2025-57756
Contao discloses sensitive information in the front end search index
Medium 5.3

Affected Vendor

Affected Software

contao
Vulnerable Versions:
>= 4.0.0, < 4.13.57, >= 5.0.0-RC1, < 5.3.42, >= 5.4.0-RC1, < 5.6.5

Timeline

Official Publish: November 25th, 2025
Last Modified: November 25th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-351

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.