Already a customer?
Log in now
You would like to become a customer?
Test trakked now
This release fixes two security vulnerabilities (CVE-2025-65960 and CVE-2025-65961). An update is recommended accordingly.
In addition, as usual, the release includes all bug fixes from the latest version 5.3.42 and fixes a bug in the permission check for the comments view in the back end. And for those using the new experimental Twig layout, there is also good news: a whole avalanche of tickets has been fixed here!
Security vulnerabilities closed:
- Remote code execution in template closures (CVE-2025-65960)
- Cross-site scripting in templates (CVE-2025-65961)
Changelog of the fixed issues in Contao 5.6.5:
- #8706 Use the attributes callback to initialize the layout template widget (aschempp)
- #9033 Output custom meta tags in Twig layouts (fritzmg)
- #9019 Check if operation description exists (aschempp)
- #9020 Fix `supportsSource` of `PageCommentsVoter` (fritzmg)
- #9025 Make class optional again for global operation with icon and button callback (fritzmg)
- #9027 Set widget error on onbeforesubmit exception (aschempp)
- #9004 Change the name of the default layout template in Twig layouts (m-vo)
- #9014 Improve the Template Studio cache invalidation (m-vo)
- #9001 Fix the picker offset in the list view (zoglo)
- #9009 Provide the index to SEAL when reindexing (Toflar)
- #8774 Add deferred execution for Twig layouts (m-vo)
- #9000 Rename the `is--hidden` class to `is-hidden` (leofeyer)
- #8988 Fix table sorting error in mutation observer (aschempp)
- #8782 Analyze if parent slots were overwritten in the Twig inspector (m-vo)
- #8989 Allow overriding the table header and footer blocks (aschempp)
- #8783 Render both content elements and front end modules in the Twig layout (m-vo)
- #8966 Increase the z-index of the jobs overlay (stefansl)
Vulnerability details
The full post is only visible for trakked customers
About Contao 5.6
The first stable version of Contao 5.6 has been released on 18 August 2025 and has been the successor of Contao 5.5. 5.6 will be updated until 14 February 2026, after which it will be replaced by Contao 5.7.
