CVE-2025-65960: Contao

Medium severity, CVSS 6.6. EPSS: 0.2% chance of exploitation in the next 30 days.

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.

Affected products

• Contao Contao: from 4.0.0, before 4.13.57 (fixed in 4.13.57); from 5.0.0, before 5.3.42 (fixed in 5.3.42); from 5.4.0, before 5.6.5 (fixed in 5.6.5)

Published 2025-11-25. Last modified 2026-06-17.