VULNERABILITY INTELLIGENCE

CVE-2025-65960

CVSS score6.6 MEDIUM
EPSS probability0.19%
CISA KEVNot currently listed
Published2025-11-25
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.

Weakness classification

  • security-advisories@github.com: CWE-351

Primary references