CVE-2025-57757 — Sensitive Information Exposure in Contao

CWE-200 — Sensitive Information ExposureCWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 86.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ContaoContao Core-bundle
Timeline
PublishedAug 28

Description

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not adding protected news archives to the news feed page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶NVDcontao/contao5.3.0 — 5.3.38+1
▶Packagistcontao/contao5.0.0-RC1 — 5.3.38+1
▶Packagistcontao/core-bundle5.0.0-RC1 — 5.3.38+1
▶CVEListV5contao/contao>= 5.0.0-RC1, < 5.3.38, >= 5.4.0-RC1, < 5.6.1+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
Contao can disclose sensitive information in the news module↗2025-08-28
▶
OSV
Contao can disclose sensitive information in the news module↗2025-08-28
▶
CVEList
Contao discloses information in the news module↗2025-08-28
▶
CVE-2025-57757 — Sensitive Information Exposure | cvebase