CVE-2025-65960

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.

CVSS 3.1

6.6CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-25)

CWE

CWE-351

Published

2025-11-25

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• contao:contao

References

• https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
• https://github.com/contao/contao/security/advisories/GHSA-98vj-mm79-v77r

Check your stackJSON