logo

Database

Security controls bypass or absence In contao/core-bundle

Description

Contao is vulnerable to remote code execution in template closures

Impact

Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.

Patches

Update to Contao 4.13.57, 5.3.42 or 5.6.5

Workarounds

Manually patch the Contao\Template::once() method.

Resources

https://contao.org/en/security-advisories/remote-code-execution-in-template-closures

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2025-659602. NVD-2025-659603. OSV-2025-659604. GHSA-98vj-mm79-v77r5. GCVE-2025-65960

References

1. https://github.com/contao/contao/security/advisories/GHSA-98vj-mm79-v77r2. https://github.com/contao/contao/commit/577d7fdd5b1ca84f65f034ff556865422f0a3bd13. https://github.com/contao/contao/commit/676f0855d39007ac9a0dbe7ae6a7414cba2312a54. https://github.com/contao/contao/commit/ebf84c90e5679a67060f396b924ce4a3c3f206b35. https://contao.org/en/security-advisories/remote-code-execution-in-template-closures

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.