GHSA-2xmj-8wmq-7475MediumCVSS 5.3
Contao discloses sensitive information in the front end search index
🔗 CVE IDs covered (1)
📋 Description
Impact
Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search.
Patches
Update to Contao 4.13.56, 5.3.38 or 5.6.1.
Workarounds
Disable the front end search.
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
🎯 Affected products6
- composer/contao/core-bundle:>= 4.9.14, < 4.13.56
- composer/contao/contao:>= 4.9.14, < 4.13.56
- composer/contao/core-bundle:>= 5.0.0-RC1, < 5.3.38
- composer/contao/core-bundle:>= 5.4.0-RC1, < 5.6.1
- composer/contao/contao:>= 5.0.0-RC1, < 5.3.38
- composer/contao/contao:>= 5.4.0-RC1, < 5.6.1
🔗 References (5)
- https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
- https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
- https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
- https://nvd.nist.gov/vuln/detail/CVE-2025-57756
- https://github.com/advisories/GHSA-2xmj-8wmq-7475