Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in versions 4.13.56, 5.3.38, and 5.6.1. A workaround involves disabling the front end search.
References
| Link | Resource |
|---|---|
| https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index | Vendor Advisory |
| https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514 | Patch |
| https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475 | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Sep 2025, 17:39
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* | |
| First Time |
Contao
Contao contao |
|
| References | () https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index - Vendor Advisory | |
| References | () https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514 - Patch | |
| References | () https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475 - Patch, Third Party Advisory |
28 Aug 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-28 17:15
Updated : 2025-09-02 17:39
NVD link : CVE-2025-57756
Mitre link : CVE-2025-57756
CVE.ORG link : CVE-2025-57756
JSON object : View
Products Affected
contao
- contao