Skip to main content
HDWSec
Medium GHSA-h57j-5f5m-789v

Contao CMS: Stored Cross-Site Scripting in the Front End Search Results

Severity
Medium
CVSS score
4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVE number(s)
GHSA-h57j-5f5m-789v
Vendor
Contao
Product
Contao CMS (contao/core-bundle, search results on legacy templates)
Affected version(s)
contao/core-bundle 4.9.0 and later
Fixed version(s)
5.3.50, 5.7.12
Vulnerability type
Stored Cross-site Scripting (CWE-79) on legacy .html5 templates
Researchers
Jean-Jamil KHALIFÉ

Presentation

Contao renders front end search results through a template. Modern Twig templates escape their output automatically, but the legacy .html5 templates inherited from earlier versions do not.

HDW Sec found that a back office page editor can store content that executes as JavaScript in the browser of any visitor running a search, on installations still using the legacy templates.

Issue(s)

  • The search result output is echoed without escaping in the legacy .html5 template path.
  • The payload is stored by a back office user with page editing rights, then triggered for any front end visitor whose search matches the poisoned content.
  • The flaw is conditional: installations that use the default Twig templates escape the value and are not affected. This condition is what bounds the score at 4.6 rather than a full stored XSS rating.
  • Contao published this at 4.6 medium; the HDW Sec report had estimated 5.4.

References

  • GitHub advisory: GHSA-h57j-5f5m-789v
  • Fixed in Contao 5.3.50 and 5.7.12, published 2026-08-25. No CVE assigned as of publication.

Our R&D hunts for vulnerabilities.

Zero-day research, reverse engineering, coordinated disclosure: discover our R&D team.

Discover our R&D All publications