CVE-2025-29790

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-29790
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29790.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-29790
Aliases
Published
2025-03-18T18:36:34Z
Modified
2026-08-12T03:51:20Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Contao allows cross-site scripting through SVG uploads
Details

Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29790.json"
}
References

Affected packages

Git / github.com/contao/contao

Affected ranges

Type
GIT
Repo
https://github.com/contao/contao
Events
Introduced
84b2fe637d5ead531f117f26b48d1b9de8df4074
Fixed
4cee054d9cc1c2bb45a4860563246572cbd5c76b
Introduced
8cb541c59cb07ecb62fc5c5685c6448f38b97ad8
Fixed
1899dd416c9849eab1b1ed5c89cfbb9785de8f22
Introduced
3173ec39227e5454439be24f7169bad5e0eb69f8
Fixed
62b1b973fbc36fbbd834ee611972bcadaf5c82d6
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.13.53"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.3.30"
        },
        {
            "introduced": "5.4.0"
        },
        {
            "fixed": "5.5.6"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29790.json"