CVE-2025-65960

Contao is vulnerable to remote code execution in template closures

State: Published
Severity: 6.6 Medium
Published: Nov 25, 2025
Updated: Nov 25, 2025
Reserved: Nov 18, 2025

Description

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-351 Insufficient Type Distinction

Affected Products

Product	Versions
contaocontao	>= 4.0.0, < 4.13.57Affected >= 5.0.0-RC1, < 5.3.42Affected >= 5.4.0-RC1, < 5.6.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.