Already a customer?
Log in now
You would like to become a customer?
Test trakked now
In addition to addressing a security vulnerability, It also improves cache invalidation for iterable collections, prevents newsletter content from being sanitized unintentionally, and fixes output encoding migrations for MariaDB. In addition, insert tags in widget values are now replaced more safely.
Security vulnerability closed:
- Server-side request forgery (SSRF) via unvalidated RSS feed URLs (CVE-2026-57232)
Changelog of the fixed issues in Contao 5.7.9:
- #10008 Apply cache tags for all iterable collections ( aschempp )
- #9993 Do not sanitize content in the newsletter reader ( ausi )
- #9985 Fix the Stimulus color picker preview and Turbo reconnect ( zoglo )
-
#9972
Do not add attributes twice in
Image::getHtml()( leofeyer ) -
#9975
Fix undefined array access when
getimagesize()fails for invalid image uploads ( qzminski ) - #9959 Fix output encoding migration for MariaDB ( ausi )
- #9922 Safely replace insert tags in widget values ( aschempp )
- #9527 Preparatory migration for output encoding ( ausi )
Details of the security vulnerability
The full post is only visible for trakked customers
About Contao 5.7 LTS
The first stable version of Contao 5.7 will be released on February 15, 2026, replacing Contao 5.3 as the long term support version. As an LTS version, 5.7 will be provided with bug fixes until February 14, 2029 and security-related updates until February 14, 2030. Contao 6.3 is the next LTS version of Contao and is due to be released in February 2028, ensuring a smooth transition.
