Read the docs
TI-2026-70131 Aliases CVE-2026-107845GHSA-628f-v4f6-p37r

Cross-site scripting in Contao comments bundle

Priority MEDIUM 42CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The contao/comments-bundle package in Contao from 4.0.0 before 5.3.50 and from 5.4.0-RC1 before 5.7.12 renders comment email and website values without sufficient attribute and URL encoding. An unauthenticated visitor can submit a comment with a crafted value, which is a cross-site scripting flaw (CWE-79). When a backend user opens the Comments module, the script runs in the Contao backend under that user's session. Moderation does not prevent exposure, since unpublished comments remain visible to moderators.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00277 20th percentileScored 2026-11-07
Fix Fixed contao (contao): 5.3.50, 5.7.12contao/comments-bundle (Packagist): 5.3.50, 5.7.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
contaocontao4.0.0 to before 5.3.50; 5.4.0-RC1 to before 5.7.125.3.50, 5.7.12Patch availableCNA
—contao/comments-bundle (Packagist)4.0.0 to before 5.3.505.3.50Patch availableGHSA-628f-v4f6-p37r
—contao/comments-bundle (Packagist)5.4.0-RC1 to before 5.7.125.7.12Patch availableGHSA-628f-v4f6-p37r
  • contao Vendorcontao Affected 4.0.0 to before 5.3.50; 5.4.0-RC1 to before 5.7.12 Fixed in 5.3.50, 5.7.12 Patch available CNA
  • contao/comments-bundle (Packagist) Vendor— Affected 4.0.0 to before 5.3.50 Fixed in 5.3.50 Patch available GHSA-628f-v4f6-p37r
  • contao/comments-bundle (Packagist) Vendor— Affected 5.4.0-RC1 to before 5.7.12 Fixed in 5.7.12 Patch available GHSA-628f-v4f6-p37r

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*——contao
  • cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* Versions — — ·contao

Remediation

Update contao/comments-bundle to 5.3.50 if it is installed before 5.3.50, or to 5.7.12 if it is installed from 5.4.0-RC1 before 5.7.12. The sources list no fixed version for contao.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA contao (contao) Fixed in 5.3.50, 5.7.12
  • Fix · GHSA-628f-v4f6-p37r contao/comments-bundle (Packagist) Fixed in 5.3.50 Advisory →
  • Fix · GHSA-628f-v4f6-p37r contao/comments-bundle (Packagist) Fixed in 5.7.12 Advisory →

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-107845
  2. 2026-10-10 Alias added: GHSA-628f-v4f6-p37r
  3. 2026-10-10 Fix available: Packagist/contao/[email protected], Packagist/contao/[email protected] · GHSA-628f-v4f6-p37r
  4. 2026-10-10 CVSS score added · GHSA-628f-v4f6-p37r
  5. 2026-10-10 Weakness changed · GHSA-628f-v4f6-p37r
  6. 2026-10-10 5 new references · GHSA-628f-v4f6-p37r
  7. 2026-10-11 Priority changed: LOW → MEDIUM

References

Other 5

  • TI-2022-09661 Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE)… CVSS 3.1CRITICAL 9.8
  • TI-2024-30849 Unrestricted file upload in Contao CVSS 3.1MEDIUM 6.4
  • TI-2023-18600 Contao cross site scripting vulnerability via input unit widget CVSS 3.1MEDIUM 6.5
  • TI-2014-01453 Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2022-08709 Cross site scripting via canonical tag CVSS 3.1HIGH 7.2
  • TI-2019-08602 Contao 4.x allows SQL Injection. CVSS 3.0CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences