CVE-2025-65960
Contao is vulnerable to remote code execution in template closures
概要
Contao is vulnerable to remote code execution in template closures
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory contao.org
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov