CVE-2025-57757: Contao Core Bundle and Contao Disclosure of Sensitive Information in News Module
Summary
CVE-2025-57757: Contao can disclose sensitive information in the news module. Affects contao/core-bundle across 2 version ranges.
>= 5.0.0-RC1, < 5.3.38
>= 5.4.0-RC1, < 5.6.1
Fixed in 5.3.38 or 5.6.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that allows users to create and manage websites with ease. It offers a range of features including a flexible layout, user management, and a powerful news module. However, certain versions of the Contao Core Bundle and Contao are vulnerable to a security issue that can lead to the unintended exposure of sensitive information through news feeds.
Vulnerability Detail
The vulnerability arises when a news feed contains protected news archives. In such cases, the news items are not properly filtered, allowing them to become publicly accessible in the RSS feed. This can lead to unauthorized access to sensitive information that should remain confidential, posing a risk to user privacy and data security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.0.0-RC1, < 5.3.385.3.38composer require contao/core-bundle:5.3.38 -
>= 5.4.0-RC1, < 5.6.15.6.1composer require contao/core-bundle:5.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, do not add protected news archives to the news feed page to prevent sensitive information from being exposed.
Conclusion
In summary, CVE-2025-57757 is a moderate severity vulnerability in the Contao Core Bundle and Contao that can lead to the exposure of sensitive information through news feeds. Users are advised to update to the latest patched versions or implement the suggested workaround to mitigate the risk.
See every vulnerability recorded for contao/core-bundle →
FAQ
CVE-2025-57757 is a vulnerability in the Contao Core Bundle and Contao that allows sensitive information to be disclosed through improperly filtered news feeds.
The vulnerability affects Contao versions starting from 5.0.0-RC1 up to 5.3.37 for the Core Bundle and up to 5.6.0 for Contao.
You can use Vulert to monitor and alert you for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
If you cannot update immediately, avoid adding protected news archives to your news feed page as a temporary workaround.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
