Already a customer?
Log in now
You would like to become a customer?
Test trakked now
Twelve vulnerabilities have been fixed. Three of them are rated critical with 9.0 to 9.8 out of 10: they affect passkey login on websites with a frontend member login, the backend file manager and the {{figure}} insert tag. We recommend updating as soon as possible.
Security vulnerabilities closed:
- Stored cross-site scripting in the file manager via crafted filenames (GHSA-xh3r-77ch-frm3)
- NoPrivateNetworkExceptRootPagesHttpClient does not pin the checked IP of cached hosts (GHSA-wvj5-rchg-986m)
- Insert tag injection in the breadcrumb module on 404 pages (GHSA-6m74-9w88-r3fh)
- Session invalidation upon enabling or disabling 2FA (GHSA-5mg3-mv6j-57wc)
- Cross-site scripting in the figure insert tag (GHSA-pc2r-hvrc-f4v6)
- Insufficient CSRF protection for backend login (GHSA-rgq4-cg48-xjxj)
- Insufficient scope validation for passkey authentication (GHSA-5mw8-wv8h-h6hx)
- Contao crawler leaks confidential headers (GHSA-26h3-f97j-vj85)
- Filemount access-control bypass in DC_Folder::editAll (GHSA-9jfh-v443-w3fj)
- Path traversal via decode-after-check in the image insert tag (GHSA-r7cf-mfp4-r23h)
- Server-side request forgery via unvalidated RSS feed URLs in the legacy module (GHSA-4mx5-xq7q-77cm)
- HTML sanitizer is vulnerable to DOM clobbering (GHSA-58r4-2p86-jp4x)
Details of the security vulnerabilities
The full post is only visible for trakked customers
About Contao 5.7 LTS
The first stable version of Contao 5.7 has been released on February 18, 2026, replacing Contao 5.3 as the long term support version. As an LTS version, 5.7 will be provided with bug fixes until February 14, 2029 and security-related updates until February 14, 2030. Contao 6.3 is the next LTS version of Contao and is due to be released in February 2028, ensuring a smooth transition.
