CVE-2025-65960: contao from 4.0.0 (inclusive), before 4.13.57 (exclusive), from 5.0.0 (inclusive), before 5.3.42 (exclusive), from…

Affected technology

contao · from 4.0.0 (inclusive), before 4.13.57 (exclusive)
contao

contao · from 5.0.0 (inclusive), before 5.3.42 (exclusive)
contao

contao · from 5.4.0 (inclusive), before 5.6.5 (exclusive)
contao

contao · >= 4.0.0, < 4.13.57, >= 5.0.0-RC1, < 5.3.42, >= 5.4.0-RC1, < 5.6.5
contao

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. Vendor/CNA’s CVSS 3.1 assessment (base score 6.6/10) rates confidentiality, integrity and availability impact as high.