CVE-2025-57756: Contao Core and Contao Bundle Sensitive Information Disclosure in Front End Search
Summary
CVE-2025-57756: Contao discloses sensitive information in the front end search index. Affects contao/core-bundle across 3 version ranges.
>= 4.9.14, < 4.13.56
>= 5.0.0-RC1, < 5.3.38
>= 5.4.0-RC1, < 5.6.1
Fixed in 4.13.56, 5.3.38 or 5.6.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that enables users to create and manage websites with ease. It offers a flexible framework for developers and a user-friendly interface for content editors. However, a vulnerability has been identified in the Contao Core Bundle and Contao package that allows sensitive information to be exposed through the front end search functionality.
Vulnerability Detail
The vulnerability arises from the improper handling of protected content elements that are rendered as fragments. These elements, which should remain confidential, are indexed and become publicly accessible via the front end search feature. This could lead to unauthorized access to sensitive information, potentially compromising user privacy and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.9.14, < 4.13.564.13.56composer require contao/core-bundle:4.13.56 -
>= 5.0.0-RC1, < 5.3.385.3.38composer require contao/core-bundle:5.3.38 -
>= 5.4.0-RC1, < 5.6.15.6.1composer require contao/core-bundle:5.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can disable the front end search feature to prevent sensitive information from being indexed. This can typically be done in the Contao settings or configuration files.
Conclusion
In summary, CVE-2025-57756 is a moderate severity vulnerability affecting the Contao Core and Contao Bundle, allowing sensitive information to be disclosed through the front end search. It is crucial to update to the patched versions or disable the search feature to protect user data.
See every vulnerability recorded for contao/core-bundle →
FAQ
CVE-2025-57756 is a vulnerability in the Contao Core and Contao Bundle that allows sensitive information to be disclosed through the front end search.
If your website uses the affected versions of Contao, sensitive content may be indexed and publicly accessible, risking user privacy.
If an immediate update is not possible, disable the front end search feature to mitigate the risk of sensitive information exposure.
More information can be found in the advisory on GitHub or by checking the Contao GitHub repository for updates.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the composer.lock file. You can check your application for this vulnerability using the Vulert playground without signing up.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
