| Package | Affected versions | Patched versions |
|---|---|---|
| contao/core-bundle | ≥ 4.0.0, < 4.13.57≥ 5.0.0-RC1, < 5.3.42≥ 5.4.0-RC1, < 5.6.5 | 4.13.575.3.425.6.5 |
| contao | ≥ 4.0.0, < 4.13.57≥ 5.0.0, < 5.3.42≥ 5.4.0, < 5.6.5 | 4.13.575.3.425.6.5 |
It is possible to inject code into the template output that will be executed in the browser in the front end and back end.
Update to Contao 4.13.57, 5.3.42 or 5.6.5.
Do not use the affected templates or patch them manually.
https://contao.org/en/security-advisories/cross-site-scripting-in-templates
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free