CVE-2026-107845 Details
Description
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.
A cross-site scripting (XSS) vulnerability has been identified in the Contao Comments Bundle, affecting versions 4.0.0 through 5.3.50 and 5.7.12. The issue allows an unauthenticated front-end visitor to post a comment containing a malicious script. This script is executed in the Contao back-end under the session of any user who opens the Comments module. Unpublished comments, which are still visible to moderators, ensure that the vulnerability is exposed rather than mitigated.
Users can upgrade to Contao versions 5.3.50 or 5.7.12 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/contao/contao/commit/22505d5f79bc1a7f52e2cba5fddf6007e1f0408a | [email protected] | Source CodeVendor |
| https://github.com/contao/contao/releases/tag/5.3.50 | [email protected] | Release NotesVendor |
| https://github.com/contao/contao/releases/tag/5.7.12 | [email protected] | Release NotesVendor |
| https://github.com/contao/contao/security/advisories/GHSA-628f-v4f6-p37r | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Contao | >= 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | New CVE Received | [email protected] |
| Oct 9, 2026 | CVE Modified | CISA-ADP |