Already a customer?
Log in now
You would like to become a customer?
Test trakked now
This is a security release, so an update is strongly recommended! In addition to the two fixed security vulnerabilities, this version also resolves various issues related to data container callbacks and cross-table DCA field references, resulting in more reliable behavior in complex configurations. The release also includes bug fixes for the job framework that ensure job attachments are updated correctly.
Security vulnerabilities closed:
- Contao crawler leaks auth credentials to external hosts (CVE-2026-55824)
- Possible path traversal in job download URIs (CVE-2026-55825)
Changelog of the fixed issues in Contao 5.7.7:
- #9906 Only allow user templates to be modified in the Template Studio ( aschempp )
-
#9882
Prevent PHP object injection in
Document::__unserialize()( XananasX7 ) - #9890 Fix more ghost target functionality in the row wizard ( zoglo )
- #9908 Fix job attachments not updating ( fritzmg )
-
#9898
Use
foreachinstead ofarray_mapto preserve cross-table DCA field references ( qzminski ) - #9864 Pass the correct DC when calling the parent table callback ( aschempp )
Vulnerability details
The full post is only visible for trakked customers
About Contao 5.7 LTS
The first stable version of Contao 5.7 will be released on February 15, 2026, replacing Contao 5.3 as the long term support version. As an LTS version, 5.7 will be provided with bug fixes until February 14, 2029 and security-related updates until February 14, 2030. Contao 6.3 is the next LTS version of Contao and is due to be released in February 2028, ensuring a smooth transition.
Add a comment