Contao Comments Bundle: Zero-Click Stored Cross-Site Scripting in the Back Office Comment List

Presentation

Contao is an open-source PHP content management system. Its comments bundle lets visitors post comments on news items, calendar events and other content, with an optional moderation queue reviewed from the back office.

HDW Sec found that an entirely unauthenticated visitor can store JavaScript that executes in the session of any back office user who opens the moderation list, with no click and no hover required. Contao rated it critical, 9.3.

Issue(s)

• RFC 5322 allows a quoted local part in an email address, and that form accepts control characters. Contao’s validator follows the standard, so it accepts them.
• The comment form encodes only one character on input, the opening angle bracket. Double quotes, the equals sign and the form feed (0x0C) are stored verbatim.
• In the back office, the comment list prints the address inside a mailto: link without escaping it, while the very same value is escaped in the neighbouring title attribute on the same line (comments-bundle/contao/dca/tl_comments.php:376).
• The quote closes the href attribute and the form feeds act as attribute separators for the HTML parser, so the local part becomes three attributes. 65 characters are allowed, which is enough room for autofocus plus an onfocus handler.
• autofocus fires onfocus on page load, so the payload runs as soon as the moderator opens the queue. The Contao back office sends no Content-Security-Policy header, so nothing stops it.

References

• GitHub advisory: GHSA-628f-v4f6-p37r
• Fixed in Contao 5.3.50 and 5.7.12, published 2026-08-25. No CVE assigned as of publication.