CVE-2026-107845 in Contao
Summary
by MITRE • 10/09/2026
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within the Contao Content Management System represents a critical cross-site scripting flaw that affects unauthenticated users through the comment submission mechanism. Spanning from version 4.0.0 up to versions 5.3.50 and 5.7.12, this issue stems from insufficient input validation and output encoding in the backend administration interface. Specifically, the function listComments located within the comments-bundle/contao/dca/tl_comments.php file fails to properly sanitize email addresses and website metadata fields when rendering them for display. This technical deficiency allows an attacker who submits a comment containing malicious script payloads via these specific metadata fields to inject executable code into the page context of the Contao backend.
The operational impact of this vulnerability is severe because it targets authenticated backend users rather than public-facing visitors. When a moderator or administrator opens the Comments module to review submissions, the browser interprets the attacker-controlled content as part of the trusted backend origin. Consequently, any script embedded in the email or website fields executes with the full privileges and session context of that logged-in user. This capability enables attackers to perform actions on behalf of the victim, such as modifying site configuration, accessing sensitive data, creating administrative accounts, or defacing the public-facing portion of the website if they have sufficient permissions within the backend environment.
A particularly dangerous aspect of this vulnerability is its persistence and stealth regarding moderation workflows. Unlike vulnerabilities that are immediately visible upon submission to a general audience, these malicious comments remain in an unpublished state until reviewed by moderators. This means that standard automated filters or public-facing sanitization measures do not mitigate the risk because the payload only executes when accessed within the secure backend environment. The requirement for human review actually facilitates the attack vector, as it ensures that the victim user with elevated privileges is the one who triggers the execution of the malicious script by viewing the comment list.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored input that is later rendered without proper encoding in a privileged context. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior maps to techniques involving client-side code injection and potentially credential access through session hijacking or privilege escalation within the application interface. The attack relies on social engineering elements where an attacker might disguise malicious payloads within seemingly benign comment submissions to bypass initial scrutiny by content moderators.
Mitigation strategies primarily involve upgrading the Contao installation to patched versions, specifically 5.3.50 and 5.7.12 or later, which address these encoding deficiencies in the listComments function. For organizations unable to upgrade immediately due to compatibility constraints with legacy extensions or custom code, temporary workarounds should focus on implementing strict input validation at the point of comment submission. This includes enforcing allowlists for email formats and restricting special characters in website URL fields before they are stored in the database. Additionally, administrators can implement Content Security Policy headers within the backend environment to restrict script execution origins, although this is a compensatory control rather than a fix for the underlying encoding flaw. Regular security audits of custom modules that interact with comment data are also recommended to ensure no similar vulnerabilities exist in other parts of the application logic.