CVE-2026-107845

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107845
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107845.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107845
Aliases
Published
2026-10-09T19:29:55Z
Modified
2026-10-10T10:45:15Z
Severity
  • 9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Contao: Cross-site scripting in the comments bundle
Details

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107845.json"
}
References

Affected packages

Git / github.com/contao/contao

Affected ranges

Type
GIT
Repo
https://github.com/contao/contao
Events
Introduced
84b2fe637d5ead531f117f26b48d1b9de8df4074
Fixed
a11109b60dedcbd99e32a4e8550afdadb500f2c5
Introduced
c5e3841e5107ab36ae2bf7795fb8d51d3d30f88b
Fixed
a6543f49a92187a7368f51b290179c4795386e23
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "5.3.50"
        },
        {
            "introduced": "5.4.0-RC1"
        },
        {
            "fixed": "5.7.12"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107845.json"