GHSA-98vj-mm79-v77rmedium6.6
Contao is vulnerable to remote code execution in template closures
Impact
Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
contao/core-bundle Packagist
| Affected range | Recorded fix |
|---|---|
| From 4.0.0 before 4.13.57Ecosystem versions | 4.13.57 |
| From 5.0.0-RC1 before 5.3.42Ecosystem versions | 5.3.42 |
| From 5.4.0-RC1 before 5.6.5Ecosystem versions | 5.6.5 |
Version evidence: OSV · GHSA-98vj-mm79-v77r
View original version evidence (435 explicit versions)
Original source description
Impact
Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.
Patches
Update to Contao 4.13.57, 5.3.42 or 5.6.5
Workarounds
Manually patch the Contao\Template::once() method.
Resources
https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
References
- Security advisory github.com/contao/contao/security/advisories/GHSA-98vj-mm79-v77r
- Security advisory nvd.nist.gov/vuln/detail/CVE-2025-65960
- Patch github.com/contao/contao/commit/577d7fdd5b1ca84f65f034ff556865422f0a3bd1
- Patch github.com/contao/contao/commit/676f0855d39007ac9a0dbe7ae6a7414cba2312a5
- Patch github.com/contao/contao/commit/ebf84c90e5679a67060f396b924ce4a3c3f206b3
- Security advisory contao.org/en/security-advisories/remote-code-execution-in-template-closures
- Source reference github.com/contao/contao