Vulnerability Description
Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in versions 4.13.56, 5.3.38, and 5.6.1. A workaround involves disabling the front end search.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Contao | Contao | >= 4.9.0, <= 4.9.14 |
Related Weaknesses (CWE)
References
- https://contao.org/en/security-advisories/information-disclosure-in-the-front-enVendor Advisory
- https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514Patch
- https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475PatchThird Party Advisory
FAQ
What is CVE-2025-57756?
CVE-2025-57756 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly availa...
How severe is CVE-2025-57756?
CVE-2025-57756 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-57756?
Check the references section above for vendor advisories and patch information. Affected products include: Contao Contao.