Contao CMS: Stored Cross-Site Scripting in the Front End Search Results

Presentation

Contao renders front end search results through a template. Modern Twig templates escape their output automatically, but the legacy .html5 templates inherited from earlier versions do not.

HDW Sec found that a back office page editor can store content that executes as JavaScript in the browser of any visitor running a search, on installations still using the legacy templates.

Issue(s)

• The search result output is echoed without escaping in the legacy .html5 template path.
• The payload is stored by a back office user with page editing rights, then triggered for any front end visitor whose search matches the poisoned content.
• The flaw is conditional: installations that use the default Twig templates escape the value and are not affected. This condition is what bounds the score at 4.6 rather than a full stored XSS rating.
• Contao published this at 4.6 medium; the HDW Sec report had estimated 5.4.

References

• GitHub advisory: GHSA-h57j-5f5m-789v
• Fixed in Contao 5.3.50 and 5.7.12, published 2026-08-25. No CVE assigned as of publication.