Cross-site scripting in Contao - #VU165873
Published: November 11, 2026
Vulnerability identifier: #VU165873
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in another back end user's browser, potentially compromising sensitive information, modifying data, and disrupting availability.
The vulnerability exists due to improper neutralization of crafted filenames in the Contao file manager when rendering stored filenames during back end interactions. A remote user can upload or rename a file with a crafted filename and induce another back end user to perform triggering actions to execute the stored script.
Affected software
Contao
Remediation
Install security update from vendor's website.
Contao - addressed in versions 5.3.54, 5.7.17, 6.0.6