CVE-2025-65960
Contao is vulnerable to remote code execution in template closures
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Contao is vulnerable to remote code execution in template closures
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
- Record
CVE-2025-65960- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-351
- Updated
- 2026-11-02
EUVDEUVD-2025-199633
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
- Record
EUVD-2025-199633- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-98vj-mm79-v77r
Contao is vulnerable to remote code execution in template closures
Impact
Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.
Patches
Update to Contao 4.13.57, 5.3.42 or 5.6.5
Workarounds
Manually patch the Contao\Template::once() method.
Resources
https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
- Record
GHSA-98vj-mm79-v77r- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-351
- Updated
- 2026-11-02
NVD
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
- Record
CVE-2025-65960- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-351
- Updated
- 2026-11-02
OSV
Contao is vulnerable to remote code execution in template closures
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
- Record
CVE-2025-65960- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-351
- Updated
- 2026-11-02
OSVGHSA-98vj-mm79-v77r
Contao is vulnerable to remote code execution in template closures
Impact
Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.
Patches
Update to Contao 4.13.57, 5.3.42 or 5.6.5
Workarounds
Manually patch the Contao\Template::once() method.
Resources
https://contao.org/en/security-advisories/remote-code-execution-in-template-closures
- Record
GHSA-98vj-mm79-v77r- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-351
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
contao/core-bundlePackagist |
4.0.0 up to 4.13.57 | 4.13.57 |
contao/core-bundlePackagist |
5.0.0-RC1 up to 5.3.42 | 5.3.42 |
contao/core-bundlePackagist |
5.4.0-RC1 up to 5.6.5 | 5.6.5 |
contao/core-bundlePackagist |
4.0.0 up to 4.13.57, plus listed versions 4.0.14.0.24.0.34.0.44.1.0 Show 45 moreShow less4.1.0-RC14.1.0-beta14.1.14.1.24.1.34.10.04.10.0-RC14.10.0-RC24.10.0-RC34.10.0-RC44.10.14.10.24.10.34.10.44.10.54.10.64.10.74.11.04.11.0-RC14.11.0-RC24.11.14.11.24.11.34.11.44.11.54.11.64.11.74.11.84.11.94.12.04.12.0-RC14.12.0-RC24.12.0-RC34.12.14.12.24.12.34.12.44.12.54.12.64.12.74.13.04.13.0-RC14.13.0-RC24.13.0-RC34.13.1 |
4.13.57 |
contao/core-bundlePackagist |
5.0.0-RC1 up to 5.3.42, plus listed versions 5.0.05.0.0-RC25.0.0-RC35.0.0-RC45.0.1 Show 45 moreShow less5.0.105.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.95.1.05.1.0-RC15.1.0-RC25.1.0-RC35.1.15.1.105.1.115.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-RC15.2.0-RC25.2.0-RC35.2.0-RC45.2.0-RC55.2.0-RC65.2.15.2.105.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.95.3.05.3.0-RC15.3.0-RC25.3.0-RC3 |
5.3.42 |
contao/core-bundlePackagist |
5.4.0-RC1 up to 5.6.5, plus listed versions 5.4.05.4.0-RC25.4.0-RC35.4.0-RC45.4.1 Show 42 moreShow less5.4.105.4.115.4.125.4.135.4.145.4.25.4.35.4.45.4.55.4.65.4.75.4.85.4.95.5.05.5.0-RC15.5.0-RC25.5.0-RC35.5.0-RC45.5.15.5.105.5.115.5.125.5.135.5.145.5.155.5.165.5.25.5.35.5.45.5.55.5.65.5.75.5.85.5.95.6.05.6.0-RC15.6.0-RC25.6.0-RC35.6.15.6.25.6.35.6.4 |
5.6.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-65960 is a medium vulnerability (CVSS 6.6) in Contao, published November 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in contao/core-bundle 4.13.57.
References
github.com/contao/contao/security/advisories/GHSA-98vj-mm79-v77r
contao.org/en/security-advisories/remote-code-execution-in-template-closures
nvd.nist.gov/vuln/detail/CVE-2025-65960
Left out here: 285 versions. The JSON record has them.