Contao CMS Critical Stored XSS Flaw in Comment Module Patched in Latest Releases

The National Vulnerability Database (NVD) has published details for CVE-2026-107845, a critical stored cross-site scripting (XSS) vulnerability in the Contao open-source content management system (CMS). The flaw affects versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11, allowing unauthenticated attackers to execute arbitrary code within the application’s backend interface.

According to the NVD record, the vulnerability stems from insufficient attribute and URL encoding of email or website metadata submitted in comments. The issue resides in the `listComments()` function within the `comments-bundle/contao/dca/tl_comments.php` file. When a backend user reviews comments, the attacker-controlled script executes in the context of the Contao backend origin under that user’s session. This creates a high-risk scenario where an attacker can potentially hijack administrator sessions or perform actions on behalf of privileged users.

The severity of this issue is rated as Critical, with a CVSS score of 9.3. The underlying weaknesses are classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-116 (Improper Encoding or Escaping of Output). Because the attack vector requires no authentication, any visitor to a Contao-powered website can potentially exploit the flaw by submitting a crafted comment.

Context and Background

The vulnerability persists even if comments are set to require moderation. The NVD record notes that unpublished comments remain visible to moderators within the backend interface. Consequently, the act of reviewing or moderating comments exposes the administrator to the malicious script. This means that standard comment moderation workflows do not mitigate the risk; in fact, they are the primary trigger for the exploit.

Contao is an open-source CMS that provides a framework for building websites and web applications. The affected versions span a significant range of the software’s history, starting from version 4.0.0. This indicates that many installations, particularly those that have not been updated recently, are likely vulnerable. The specific versions identified as fixed are 5.3.50 and 5.7.12. Any installation running a version lower than these specific builds is considered at risk.

Who is affected

Administrators and security teams managing Contao CMS installations need to verify their current version immediately. The vulnerability affects all versions from 4.0.0 up to, but not including, 5.3.50. It also affects versions from 5.4.0-RC1 up to, but not including, 5.7.12. Organizations using the 5.3 branch should update to 5.3.50, while those on the 5.7 branch should move to 5.7.12.

The impact is most severe for sites that allow public commenting. However, even if public commenting is disabled, any mechanism that allows data to be stored and rendered in the backend comments module could potentially be leveraged if other input vectors exist. The primary attack path, however, remains the public comment submission feature.

What should you do?

Security professionals should prioritize updating their Contao installations to the patched versions. If immediate updating is not possible, administrators should consider disabling the comment functionality entirely to reduce the attack surface. Monitoring backend access logs for unusual activity may also help detect potential exploitation attempts.