CVE-2025-65960

Packagist/contao/core-bundle CVE-2025-65960: medium 6.6

Contao is vulnerable to remote code execution in template closures

Action: Upgrade contao/core-bundle to 4.13.57 or later.

composer require contao/core-bundle:4.13.57

composer require contao/core-bundle:5.3.42

composer require contao/core-bundle:5.6.5

Affected

Fixed versions

Sources

• osv: GHSA-98vj-mm79-v77r
• https://github.com/contao/contao/security/advisories/GHSA-98vj-mm79-v77r
• https://nvd.nist.gov/vuln/detail/CVE-2025-65960
• https://github.com/contao/contao/commit/577d7fdd5b1ca84f65f034ff556865422f0a3bd1
• https://github.com/contao/contao/commit/676f0855d39007ac9a0dbe7ae6a7414cba2312a5
• https://github.com/contao/contao/commit/ebf84c90e5679a67060f396b924ce4a3c3f206b3
• https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
• https://github.com/contao/contao

CVE-2025-65960 · published 2025-11-25T20:43:13Z · modified 2025-11-27T09:16:46.144128Z · JSON