What is GHSA-68q5-78xp-cwwc?

GHSA-68q5-78xp-cwwc is a security advisory published by GitHub Security Advisories with Low severity. Contao is vulnerable to cross-site scripting in templates

Which CVE IDs does GHSA-68q5-78xp-cwwc cover?

GHSA-68q5-78xp-cwwc covers the following CVE IDs: CVE-2025-65961. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-68q5-78xp-cwwc?

GHSA-68q5-78xp-cwwc has a CVSS v3 base score of 3.3, published by GitHub Security Advisories.

Which products are affected by GHSA-68q5-78xp-cwwc?

GHSA-68q5-78xp-cwwc affects 3 products, including: composer/contao/core-bundle:\u003e= 4.0.0, \u003c 4.13.57; composer/contao/core-bundle:\u003e= 5.0.0-RC1, \u003c 5.3.42; composer/contao/core-bundle:\u003e= 5.4.0-RC1, \u003c 5.6.5.

GHSA-68q5-78xp-cwwcLowCVSS 3.3

Contao is vulnerable to cross-site scripting in templates

Vendor

GitHub Security Advisories

Published

November 25, 2025

Last Modified

December 3, 2025

🔗 CVE IDs covered (1)

CVE-2025-65961 →

📋 Description

Impact

It is possible to inject code into the template output that will be executed in the browser in the front end and back end.

Patches

Update to Contao 4.13.57, 5.3.42 or 5.6.5.

Workarounds

Do not use the affected templates or patch them manually.

Refsources

https://contao.org/en/security-advisories/cross-site-scripting-in-templates

🎯 Affected products3

composer/contao/core-bundle:>= 4.0.0, < 4.13.57
composer/contao/core-bundle:>= 5.0.0-RC1, < 5.3.42
composer/contao/core-bundle:>= 5.4.0-RC1, < 5.6.5

🔗 References (4)

https://github.com/contao/contao/security/advisories/GHSA-68q5-78xp-cwwc
https://contao.org/en/security-advisories/cross-site-scripting-in-templates
https://nvd.nist.gov/vuln/detail/CVE-2025-65961
https://github.com/advisories/GHSA-68q5-78xp-cwwc