Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-57757

Contao discloses information in the news module

Description

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not adding protected news archives to the news feed page.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

contao contao

  • >= 5.0.0-RC1, < 5.3.38affected
  • >= 5.4.0-RC1, < 5.6.1affected

References