Read the docs
TI-2025-35644 Aliases CVE-2025-57759GHSA-qqfq-7cpp-hcqj

Contao has improper privilege management for page and article fields

Priority LOW 20CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Fixed contao (contao): 5.3.38, 5.6.1contao/core-bundle (Packagist): 5.3.38, 5.6.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
contaocontao5.3.0 to before 5.3.38; 5.4.0-RC1 to before 5.6.15.3.38, 5.6.1Patch availableCNA
—contao/core-bundle (Packagist)5.3.0 to before 5.3.385.3.38Patch availableGHSA-qqfq-7cpp-hcqj
—contao/core-bundle (Packagist)5.4.0-RC1 to before 5.6.15.6.1Patch availableGHSA-qqfq-7cpp-hcqj
—contao/contao (Packagist)5.3.0 to before 5.3.385.3.38Patch availableGHSA-qqfq-7cpp-hcqj
—contao/contao (Packagist)5.4.0-RC1 to before 5.6.15.6.1Patch availableGHSA-qqfq-7cpp-hcqj
  • contao Vendorcontao Affected 5.3.0 to before 5.3.38; 5.4.0-RC1 to before 5.6.1 Fixed in 5.3.38, 5.6.1 Patch available CNA
  • contao/core-bundle (Packagist) Vendor— Affected 5.3.0 to before 5.3.38 Fixed in 5.3.38 Patch available GHSA-qqfq-7cpp-hcqj
  • contao/core-bundle (Packagist) Vendor— Affected 5.4.0-RC1 to before 5.6.1 Fixed in 5.6.1 Patch available GHSA-qqfq-7cpp-hcqj
  • contao/contao (Packagist) Vendor— Affected 5.3.0 to before 5.3.38 Fixed in 5.3.38 Patch available GHSA-qqfq-7cpp-hcqj
  • contao/contao (Packagist) Vendor— Affected 5.4.0-RC1 to before 5.6.1 Fixed in 5.6.1 Patch available GHSA-qqfq-7cpp-hcqj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*5.3.0 to before 5.3.38; 5.4.0 to before 5.6.1Vulnerablecontao
  • cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* Versions 5.3.0 to before 5.3.38; 5.4.0 to before 5.6.1 Vulnerable ·contao

Remediation

  • Fix · CNA contao (contao) Fixed in 5.3.38, 5.6.1
  • Fix · GHSA-qqfq-7cpp-hcqj contao/core-bundle (Packagist) Fixed in 5.3.38 Advisory →
  • Fix · GHSA-qqfq-7cpp-hcqj contao/core-bundle (Packagist) Fixed in 5.6.1 Advisory →
  • Fix · GHSA-qqfq-7cpp-hcqj contao/contao (Packagist) Fixed in 5.3.38 Advisory →
  • Fix · GHSA-qqfq-7cpp-hcqj contao/contao (Packagist) Fixed in 5.6.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-57759
  2. 2026-10-03 Alias added: GHSA-qqfq-7cpp-hcqj

References

Patch 2

Advisory 2

Other 1

  • TI-2022-09661 Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE)… CVSS 3.1CRITICAL 9.8
  • TI-2024-30849 Unrestricted file upload in Contao CVSS 3.1MEDIUM 6.4
  • TI-2023-18600 Contao cross site scripting vulnerability via input unit widget CVSS 3.1MEDIUM 6.5
  • TI-2022-08709 Cross site scripting via canonical tag CVSS 3.1HIGH 7.2
  • TI-2019-08602 Contao 4.x allows SQL Injection. CVSS 3.0CRITICAL 9.8
  • TI-2024-30447 Remote command execution through file upload in contao/core-bundle CVSS 3.1HIGH 8.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences