Already a customer?
Log in now
You would like to become a customer?
Test trakked now
As always, this release contains all bug fixes from the latest 5.3.38. A total of 4 security vulnerabilities have been fixed. All 4 were classified as moderate and, in accordance with the recently announced changes to the security policy, were not announced in advance. In addition, Turbo integration has been improved and, among other things, auto-focus has been restored. Moving multiple records via the clipboard was faulty and is now also possible again.
Security vulnerabilities closed:
- Information disclosure in the front end search index (CVE-2025-57756)
- Information disclosure in the news module (CVE-2025-57757)
- Improper access control in the back end voters (CVE-2025-57758)
- Improper privilege management for page and article fields (CVE-2025-57759)
Changelog of the fixed issues in Contao 5.6.1:
- #8747 Correctly handle non-array DCA operation labels (aschempp)
- #8743 Check if there are arguments before using `func_get_arg()` (leofeyer)
- #8736 Fix moving multiple items via the clipboard (aschempp)
- #8720 Do not create a response context if one already exists (fritzmg)
- #8667 Update the `input-map` CSS to match the previous `MooTools Sortables` (zoglo)
- #8710 Only apply the Turbo request cache to 200 OK responses (Toflar)
- #8707 Fix the search indexer migration when migrating from Contao 4.13 to 5.6 (fritzmg)
- #8715 Restore the previous `autoFocus` when navigating with Turbo Drive (zoglo)
- #8603 Fix the `getAllEvents` hook (fritzmg)
- #8700 A completed job must always be set to 100% progress (Toflar)
- #8689 Update to SEAL 0.12 (Toflar)
Vulnerability details
The full post is only visible for trakked customers
About Contao 5.6
The first stable version of Contao 5.6 has been released on 18 August 2025 and has been the successor of Contao 5.5. 5.6 will be updated until 14 February 2026, after which it will be replaced by Contao 5.7.
