CVE-2025-65960: 
PHP vulnerability analysis and mitigation

CVE-2025-65960 is a remote code execution vulnerability in Contao Open Source CMS affecting the template closure mechanism. Back-end users with precise control over template closure contents can execute arbitrary PHP functions that do not have required parameters. The vulnerability affects Contao versions 4.0.0 through before 4.13.57, 5.0.0-RC1 through before 5.3.42, and 5.4.0-RC1 through before 5.6.5. It was published on November 25, 2025, with patches released the same day. It carries a CVSS v3.1 base score of 6.6 (Moderate) (GitHub Advisory, Contao Advisory).

The root cause is classified as CWE-351 (Insufficient Type Distinction), where the Contao\Template::once() method fails to properly distinguish between different types of elements passed within template closures, allowing callable PHP function names to be injected and invoked. An authenticated back-end user who has edit access to template closure contents can craft input that causes the CMS to call arbitrary PHP built-in or user-defined functions that require no parameters (e.g., phpinfo, system with no args, etc.). Exploitation requires high privileges (back-end access) and high attack complexity, as the attacker must have precise control over the template closure content. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, GitHub Advisory).

Successful exploitation allows an authenticated back-end user to achieve remote code execution on the server hosting the Contao CMS instance. The impact spans all three security dimensions: high confidentiality impact (access to sensitive data and server resources), high integrity impact (ability to modify files, database content, or system state), and high availability impact (potential to disrupt or crash the service). This could enable an attacker to pivot laterally within the hosting environment, exfiltrate sensitive data, or establish persistent access (GitHub Advisory, Contao Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.02% (6th percentile), indicating a low near-term probability of exploitation. Exploitation is constrained by the requirement for high-privilege back-end access and high attack complexity, limiting the realistic attacker pool to insiders or compromised privileged accounts (GitHub Advisory).

1. Gain Back-End Access: Obtain credentials for a Contao back-end user account with permissions to edit template closures (requires high-privilege access, e.g., through credential theft, phishing, or insider threat).
2. Locate Template Closure Editing Interface: Navigate to the Contao back-end and identify a template or content element that exposes closure content editing, where the Template::once() method is invoked.
3. Inject Malicious PHP Function Reference: Craft input within the template closure that references an arbitrary PHP function name (without required parameters) such as phpinfo or another callable, exploiting the insufficient type distinction in Template::once().
4. Trigger Execution: Save and render the template, causing the Contao CMS to invoke the injected PHP function server-side, achieving code execution under the web server's process context.
5. Escalate or Persist: Use the achieved code execution to deploy a web shell, exfiltrate data, or establish persistence on the server (GitHub Advisory).

• Logs: Contao back-end access logs showing unusual template save or render actions by privileged users, particularly involving template closure fields with unexpected PHP function names as values.
• Logs: PHP error logs or application logs showing unexpected function calls (e.g., phpinfo(), system(), exec()) originating from the Contao template rendering process.
• File System: Presence of newly created or modified PHP files (web shells) in the Contao web root or upload directories following back-end template edits.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, curl, wget, python) that are not part of normal CMS operation.
• Network: Unexpected outbound connections from the web server to external IPs, potentially indicating reverse shell or data exfiltration activity following template rendering.

Contao has released patched versions addressing this vulnerability: 4.13.57, 5.3.42, and 5.6.5. Administrators should upgrade to one of these versions immediately. For those unable to patch immediately, a workaround is available by manually patching the Contao\Template::once() method to enforce proper type distinction. Additionally, limiting back-end user privileges, enforcing strong authentication (e.g., MFA), and auditing which users have template closure editing access can reduce the attack surface (GitHub Advisory, Contao Advisory).

The vulnerability was published and reviewed by the GitHub Advisory Database on November 25, 2025, with credits to security researchers ausi and m-vo as finders. The advisory was published by Contao maintainer leofeyer. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability database aggregation and automated social media CVE tracking posts (GitHub Advisory).