VULNERABILITY INTELLIGENCE

CVE-2025-57756

CVSS score5.3 MEDIUM

EPSS probability0.30%

CISA KEVNot currently listed

Published2025-08-28

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in versions 4.13.56, 5.3.38, and 5.6.1. A workaround involves disabling the front end search.

Weakness classification

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-612: Improper Authorization of Index Containing Sensitive Information

Primary references

security-advisories@github.com — Vendor Advisory
security-advisories@github.com — Patch
security-advisories@github.com — Patch, Third Party Advisory