Already a customer?
Log in now
You would like to become a customer?
Test trakked now
This security release addresses a total of eleven (!) vulnerabilities: one of which is classified as critical according to its respective CVSS score. All vulnerabilities are assigned a CVE number or GHSA number and are reported to the relevant security databases so that automated tools such as trakked can detect affected installations.
Security vulnerabilities closed:
- Exposure of sensitive information through a stale search index (GHSA-x2rp-9qf7-2fmq)
- Unrestricted activation email resending (GHSA-mfxh-vp55-7gc6)
- Cross-site request forgery in custom backend actions (GHSA-9ff2-p842-45wq)
- Path traversal in the images controller (GHSA-mrvp-7wmx-5m4h)
- Cross-site scripting in the comments bundle (GHSA-628f-v4f6-p37r)
- Improper access control in the preview links module (GHSA-q6wp-fr43-gm9v)
- Cross-site scripting in the frontend search results (GHSA-h57j-5f5m-789v)
- Non-admin users can self-grant permissions that implicitly make them administrators (GHSA-r9qp-pqx5-8369)
- Improper access control in the CSV import wizard (GHSA-23w9-4pg3-xwm3)
- Improper access control in the newsletter module (GHSA-3r9g-pfhv-3228)
- Improper access control in the table access voter (GHSA-5974-gfqc-wrcm)
Vulnerability details
The full post is only visible for trakked customers
About Contao 5.7 LTS
The first stable version of Contao 5.7 will be released on February 15, 2026, replacing Contao 5.3 as the long term support version. As an LTS version, 5.7 will be provided with bug fixes until February 14, 2029 and security-related updates until February 14, 2030. Contao 6.3 is the next LTS version of Contao and is due to be released in February 2028, ensuring a smooth transition.
