CVE-2025-65961CWE-79CWE-87cross-site-scripting

CVE-2025-65961

Low · published November 26, 2025

CVSS v3.1

3.3

EPSS

Percentile

5.6

In the wild

Unconfirmed

What it is

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.

The record

Technical detail

CVSS v3.1: 3.3 · LOW
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00167 · 5.6th percentile
Weaknesses: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-87 · Improper Neutralization of Alternate XSS Syntax
Published: 2025-11-26T00:15Z

Affected products (3)

Product	Versions	Fixed in
contao/contao	≥ 4.0.0, < 4.13.57	4.13.57
contao/contao	≥ 5.0.0, < 5.3.42	5.3.42
contao/contao	≥ 5.4.0, < 5.6.5	5.6.5

References (2)

https://contao.org/en/security-advisories/cross-site-scripting-in-templates · [email protected]https://github.com/contao/contao/security/advisories/GHSA-68q5-78xp-cwwc · [email protected]

EPSS history

Timeline

25 NOV 19:06Z
Contao is vulnerable to cross-site scripting in templates
cvelistv5