CVE-2020-25768: Contao

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.

Affected products

• Contao Contao: from 4.0, before 4.4.52 (fixed in 4.4.52); from 4.9.0, before 4.9.6 (fixed in 4.9.6); from 4.10.0, before 4.10.1 (fixed in 4.10.1)

Published 2020-10-07. Last modified 2026-06-17.