{"id":"CVE-2026-107845","published":"2026-10-09T20:17:10.457","lastModified":"2026-10-09T20:17:10.457","description":"Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79","CWE-116"],"vendors":[],"products":[],"references":[{"url":"https://github.com/contao/contao/commit/22505d5f79bc1a7f52e2cba5fddf6007e1f0408a","tags":[]},{"url":"https://github.com/contao/contao/releases/tag/5.3.50","tags":[]},{"url":"https://github.com/contao/contao/releases/tag/5.7.12","tags":[]},{"url":"https://github.com/contao/contao/security/advisories/GHSA-628f-v4f6-p37r","tags":[]}],"exploitRefs":[{"url":"https://github.com/contao/contao/commit/22505d5f79bc1a7f52e2cba5fddf6007e1f0408a","tags":[]},{"url":"https://github.com/contao/contao/releases/tag/5.3.50","tags":[]},{"url":"https://github.com/contao/contao/releases/tag/5.7.12","tags":[]},{"url":"https://github.com/contao/contao/security/advisories/GHSA-628f-v4f6-p37r","tags":[]}],"hasPoc":true,"ai":{"summary":"A stored cross-site scripting (XSS) vulnerability exists in Contao CMS where unauthenticated users can submit comments containing malicious scripts that execute in the backend context when moderators view them. This allows attackers to hijack moderator sessions and potentially gain full administrative access.","exploitability":"Easy to exploit with no prerequisites - attackers simply need to submit a comment with malicious script in email or website fields, which then executes when backend users view the comments module.","blast_radius":"High impact in environments where moderators regularly review comments, as attackers can execute arbitrary code in the context of high-privilege backend sessions and potentially escalate to full system compromise.","remediation":"Upgrade to version 5.3.50 or 5.7.12 immediately to patch the XSS vulnerability in comments-bundle/contao/dca/tl_comments.php.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","cms","session-hijack"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:52:05.504Z"}}