by Kastro
Paper/Archive/CVE-2026-107845

CVE-2026-107845

contao contao — Contao: Cross-site scripting in the comments bundle

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
32
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 20.1.201 × 204.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.

Affected

ProductAffectedFixed inSource
contao>= 4.0.0, < 5.3.50–CNA
contao>= 5.4.0-RC1, < 5.7.12–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/contao/contao/security/advisories/GHSA-628f-v4f6-p37rrefgithub.com/contao/contao/commit/22505d5f79bc1a7f52e2cba5fddf6007e1f0408arefgithub.com/contao/contao/releases/tag/5.3.50refgithub.com/contao/contao/releases/tag/5.7.12