Already a customer?
Log in now
You would like to become a customer?
Test trakked now
This release is a security release! A total of 4 security vulnerabilities have been fixed. All 4 were classified as moderate and, in accordance with the recently announced changes to the security policy, were not announced in advance. In addition, errors in the permission check that e.g. prevented the creation of new pages, have been fixed. It is now also possible to embed two or more registration forms on the same page without the CAPTCHA mechanism failing, and the migration of old 4.13 databases has been improved.
Security vulnerabilities closed:
- Information disclosure in the front end search index (CVE-2025-57756)
- Information disclosure in the news module (CVE-2025-57757)
- Improper access control in the back end voters (CVE-2025-57758)
- Improper privilege management for page and article fields (CVE-2025-57759)
Changelog of the fixed issues in Contao 5.3.38:
- #8741 Add an ID to the CAPTCHA in the registration form (fritzmg)
- #8727 Deprecate some user variables (fritzmg)
- #8729 Do not use the request locale in the `Countries` and `Locales` classes (ausi)
- #8726 Allow to create a user without a request (aschempp)
- #8580 Add the group index and count to events (fritzmg)
- #8708 Add a higher priority to the `BooleanFieldsMigration` (fritzmg)
- #8701 Check undefined global `objPage` (bytehead)
- #8698 Fix the invalid permission check in `tl_content` (aschempp)
- #8694 Fix the compatibility with `php-feed-io/feed-io` 6.1.1 (ausi)
- #8681 Only vote on `pid` and `ptable` for parent mode (aschempp)
- #8675 Check for main request in the `PreviewToolbarListener` (fritzmg)
Vulnerability details
The full post is only visible for trakked customers
About Contao 5.3 LTS
The first stable version of Contao 5.3 has been released on February 16, 2024, replacing Contao 4.13 as the long term support version. As an LTS version, 5.3 will be provided with bug fixes until February 14, 2027 and security-related updates until February 14, 2028. Contao 5.7 has been the next LTS version of Contao and will be released in February 2026, ensuring a stress-free transition.
