Already a customer?
Log in now
You would like to become a customer?
Test trakked now
This release is a security release! A total of 4 security vulnerabilities have been fixed. All 4 were classified as moderate and, in accordance with the recently announced changes to the security policy, were not announced in advance. In addition, errors in the permission check that e.g. prevented the creation of new pages, have been fixed. It is now also possible to embed two or more registration forms on the same page without the CAPTCHA mechanism failing, and the migration of old 4.13 databases has been improved.
Security vulnerabilities closed:
- Information disclosure in the front end search index (CVE-2025-57756)
- Information disclosure in the news module (CVE-2025-57757)
- Improper access control in the back end voters (CVE-2025-57758)
- Improper privilege management for page and article fields (CVE-2025-57759)
Changelog of the fixed issues in Contao 5.3.38:
- #8741 Add an ID to the CAPTCHA in the registration form ( fritzmg )
- #8727 Deprecate some user variables ( fritzmg )
-
#8729
Do not use the request locale in the
CountriesandLocalesclasses ( ausi ) - #8726 Allow to create a user without a request ( aschempp )
- #8580 Add the group index and count to events ( fritzmg )
-
#8708
Add a higher priority to the
BooleanFieldsMigration( fritzmg ) -
#8701
Check undefined global
objPage( bytehead ) -
#8698
Fix the invalid permission check in
tl_content( aschempp ) -
#8694
Fix the compatibility with
php-feed-io/feed-io6.1.1 ( ausi ) -
#8681
Only vote on
pidandptablefor parent mode ( aschempp ) -
#8675
Check for main request in the
PreviewToolbarListener( fritzmg )
Vulnerability details
The full post is only visible for trakked customers
About Contao 5.3 LTS
The first stable version of Contao 5.3 has been released on February 16, 2024, replacing Contao 4.13 as the long term support version. As an LTS version, 5.3 will be provided with bug fixes until February 14, 2027 and security-related updates until February 14, 2028. Contao 5.7 is the next LTS version of Contao and was released in February 2026, ensuring a smooth transition.
Add a comment