{"action":"Upgrade contao/core-bundle to 4.13.57 or later.","affected":[{"fixed":"4.13.57","introduced":"4.0.0"},{"fixed":"5.3.42","introduced":"5.0.0-RC1"},{"fixed":"5.6.5","introduced":"5.4.0-RC1"}],"component":"contao/core-bundle","cve_ids":["CVE-2025-65960"],"ecosystem":"Packagist","epss":0.0019,"exploited":false,"fixed_versions":["4.13.57","5.3.42","5.6.5"],"ghsa_id":"GHSA-98vj-mm79-v77r","id":"tcs_01M5KEZVJ87A4CZ0WQVEFDX232","modified_at":"2025-11-27T09:16:46.144128Z","published_at":"2025-11-25T20:43:13Z","references":["https://osv.dev/vulnerability/GHSA-98vj-mm79-v77r","https://github.com/contao/contao/security/advisories/GHSA-98vj-mm79-v77r","https://nvd.nist.gov/vuln/detail/CVE-2025-65960","https://github.com/contao/contao/commit/577d7fdd5b1ca84f65f034ff556865422f0a3bd1","https://github.com/contao/contao/commit/676f0855d39007ac9a0dbe7ae6a7414cba2312a5","https://github.com/contao/contao/commit/ebf84c90e5679a67060f396b924ce4a3c3f206b3","https://contao.org/en/security-advisories/remote-code-execution-in-template-closures","https://github.com/contao/contao"],"severity":{"label":"medium","score":6.6},"sources":[{"source":"osv","source_id":"GHSA-98vj-mm79-v77r","url":"https://osv.dev/vulnerability/GHSA-98vj-mm79-v77r"}],"summary":"Contao is vulnerable to remote code execution in template closures"}