Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control…
GitHub_M·CWE-351·Published 2025-11-25
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
### Impact Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. ### Patches Update to Contao 4.13.57, 5.3.42 or 5.6.5 ### Workarounds Manually patch the `Contao\Template::once()` method. ### Resources https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
### Impact Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. ### Patches Update to Contao 4.13.57, 5.3.42 or 5.6.5 ### Workarounds Manually patch the `Contao\Template::once()` method. ### Resources https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
Contao es un CMS de código abierto. Desde la versión 4.0.0 hasta la 4.13.57, hasta la 5.3.42, y hasta la 5.6.5, los usuarios del back end con control preciso sobre el contenido de los cierres de plantilla pueden ejecutar funciones PHP arbitrarias que no tienen parámetros requeridos. Este problema ha sido parcheado en las versiones 4.13.57, 5.3.42 y 5.6.5. Una solución alternativa para este problema implica parchear manualmente el método Contao\Template::once().
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 6.6 | — | — | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | Primary | cve.org | 6.6 | — | — | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | Secondary | GHSA | 6.6 | — | — | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | Secondary | NVD | 6.6 | 0.7 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |