CVE-2025-65961 - CVE House
Back to Database
Status published Low CVE-2025-65961

Contao is vulnerable to cross-site scripting in templates

Vulnerability Description

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65961

Credits & Attribution

No credits recorded in the NVD database.

References

More from contao

View All →
CVE-2025-65960
Contao is vulnerable to remote code execution in template closures
Medium 6.6
CVE-2025-57759
Contao has improper privilege management for page and article fields
Medium 4.3
CVE-2025-57758
Contao has improper access control in the back end voters
Medium 4.3
CVE-2025-57757
Contao discloses information in the news module
Medium 5.3
CVE-2025-57756
Contao discloses sensitive information in the front end search index
Medium 5.3

Affected Vendor

Affected Software

contao
Vulnerable Versions:
>= 4.0.0, < 4.13.57, >= 5.0.0-RC1, < 5.3.42, >= 5.4.0-RC1, < 5.6.5

Timeline

Official Publish: November 25th, 2025
Last Modified: November 25th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-87

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.